Question 1

How do you manage sessions and authentication in a Node.js web application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and system-design interviews — assumes familiarity with the 12-factor app question's real stateless-processes proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the session revocation and the JWT tamper-detection below were **actually run** — a real 401 after a real logout, and a real signature-check rejection of a genu

Question 2

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and API-security interviews — assumes familiarity with this bank's dedicated session-vs-JWT fundamentals question. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The real refresh flow, replay attempt, and family revocation below were **actually run** with Node's built-in `crypto` module — genuine HMAC signing, a genuine expiry fa

Question 3

How do you secure your Node.js API endpoints?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js API-security system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `helmet()` header comparison below was **actually run** against two real Express servers on Node v24.19.0. ## 1. Why This Even Matters — A Story First A building's real security

NODE.JSDECODED.

Medium

How do you manage sessions and authentication in a Node.js web application?

What is the difference between JWT and session-based authentication, and where do refresh tokens fit?

Hard

How do you secure your Node.js API endpoints?