Question 1

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 2

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 3

How do you implement Server-Sent Events (SSE) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js real-time-communication interviews — assumes familiarity with the WebSockets question's real bidirectional proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The real events below were **actually streamed** from a real server to a real client over one connection — genuine timestamps roughly 100ms apart, not a single buffered response. ##

Question 4

How do you implement rate limiting in a Node.js Express application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes basic Express middleware familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The rate-limiter behavior below was **actually run** against a real Express server on Node v24.19.0 — real status codes and real header values, directly answering the prompt's own request to verify it. ## 1. Why This Even Matters

Question 5

What are some common security best practices in Node.js applications?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `npm audit` and `helmet` results below came from **actually running both** against a real, deliberately-vulnerable setup on Node v24.19.0. ## 1. Why This Even Matters — A St

Question 6

What is undici and why is the global fetch built on it in modern Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js networking and standard-library internals interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The internal proof below was **actually run** — real `undici`-namespaced `diagnostics_channel` events genuinely fired during a plain global `fetch()` call, and `require("node:undici")` genuinely threw the error shown, not descriptions of docum

Question 7

What is the purpose of the 'zlib' module in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic Buffer/stream familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The compression numbers below came from **actually running** `zlib.gzipSync`/`gunzipSync` on Node v24.19.0 — real byte counts, not estimated ratios. ## 1. Why This Even Matters — A Story First Vacuum-sealing clothes for storage shrinks them

Question 8

How do you secure your Node.js API endpoints?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js API-security system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `helmet()` header comparison below was **actually run** against two real Express servers on Node v24.19.0. ## 1. Why This Even Matters — A Story First A building's real security

NODE.JSDECODED.

Easy