Question 1

How do you enable gzip/Brotli compression for HTTP responses?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express performance interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The real byte counts below are **actual, measured** raw wire bytes, captured via a client that bypasses automatic decompression specifically to measure what's genuinely sent — not illustrative numbers. ## 1. Why This Even Matters — A Story First Shipping a box stuf

Question 2

Explain the concept of 'middleware' in Express.js.

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes no prior Express-specific knowledge. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The chain-ordering and short-circuiting behavior below was **actually run** against a real Express server — genuine console output, not a description of intended behavior. ## 1. Why This Even Matters — A Story First An airport secu

Question 3

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 4

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 5

How do you handle errors in Node.js applications?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic Express and Promise familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The Express behavior below was **actually executed** against a real Express 4.22.2 server, including a real crash, not described from documentation. ## 1. Why This Even Matters — A Story First A building's fire-alarm system automatical

Question 6

How do you protect a Node.js API against Denial of Service (DoS) and brute-force attacks?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused system-design interviews — assumes familiarity with the password-hashing question's real verified demonstration. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The rate-limiter behavior below was **actually run** against a real Express server on Node v24.19.0 — real HTTP status codes, not a description of the intended behavio

Question 7

How do you implement rate limiting in a Node.js Express application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express interviews — assumes basic Express middleware familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The rate-limiter behavior below was **actually run** against a real Express server on Node v24.19.0 — real status codes and real header values, directly answering the prompt's own request to verify it. ## 1. Why This Even Matters

Question 8

How do you handle uncaught exceptions and unhandled promise rejections in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic Promise/async familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the handled and the genuinely unhandled (crashing) cases below were **actually executed** on Node v24.19.0 — a real exit code, not an assumption. ## 1. Why This Even Matters — A Story First A building has two entirely separate emergency

Question 9

What is the purpose of the 'zlib' module in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic Buffer/stream familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The compression numbers below came from **actually running** `zlib.gzipSync`/`gunzipSync` on Node v24.19.0 — real byte counts, not estimated ratios. ## 1. Why This Even Matters — A Story First Vacuum-sealing clothes for storage shrinks them

Question 10

Fastify vs Express — how do they differ in architecture and performance?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js backend interviews — assumes basic Express familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Section 3 is a **real Fastify 5.12.4 server, actually run** across five variations of the same schema — and running all five is what corrected a wrong first guess before it went into this doc. See the note there. ## 1. Why This Even Matters

NODE.JSDECODED.

Easy