Question 1

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express and web-security interviews. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header behavior below was **actually observed** from a real running Express server with the real `cors` middleware — genuine response headers, not a description of intended behavior. ## 1. Why This Even Matters — A Story First A nightclub bouncer checks

Question 2

What are the main security risks of using the 'eval()' function in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — no prior security background assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every consequence below was **actually demonstrated by running real code**, not described as a hypothetical. ## 1. Why This Even Matters — A Story First Handing a stranger a blank check with your signature already on it is fun

Question 3

How can you securely store and verify passwords in a Node.js application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused phone screens — assumes very basic hashing familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The hash/verify pair below was **actually run** on Node v24.19.0, using only Node's built-in `crypto` module — no external package installed. ## 1. Why This Even Matters — A Story First A safe-deposit box's combination is ne

Question 4

How do you handle environment variables in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior configuration-management experience assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The string-coercion behavior below was **actually verified** on Node v24.19.0, not assumed from how JavaScript "usually" handles types. ## 1. Why This Even Matters — A Story First A form field that only accepts typed text will

Question 5

What is CSRF and how do you protect a Node.js API against it?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security interviews — assumes basic cookies and HTTP request familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Section 3 was **tested live in a real browser** against two actual local origins, not simulated — the exact cookies seen by the server on each request type are pasted in. ## 1. Why This Even Matters — A Story First A guar

Question 6

How do you manage configuration in a Node.js application for different environments?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic `process.env` familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The config-switching behavior below was **actually run** across three different `NODE_ENV` values on Node v24.19.0, including the failure case. ## 1. Why This Even Matters — A Story First A single stage play script works in two different the

Question 7

How do you manage sessions and authentication in a Node.js web application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js authentication and system-design interviews — assumes familiarity with the 12-factor app question's real stateless-processes proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the session revocation and the JWT tamper-detection below were **actually run** — a real 401 after a real logout, and a real signature-check rejection of a genu

Question 8

How does Node.js handle crypto operations efficiently without blocking the event loop?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js interviews — assumes basic event-loop and thread-pool familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the frozen and the free heartbeat below were **actually measured** on Node v24.19.0, using the identical computation in both cases. ## 1. Why This Even Matters — A Story First A single cashier who personally walks to a back

Question 9

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 10

Explain how the 'crypto' module secures sensitive data in Node.js

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security-focused interviews — assumes basic hashing/encryption vocabulary. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the successful decryption and the tamper-rejection below were **actually run** on Node v24.19.0 — a real thrown authentication error, not a description of what should happen. ## 1. Why This Even Matters — A Story Fir

NODE.JSDECODED.

Easy

How do you handle CORS (Cross-Origin Resource Sharing) in Node.js?

What are the main security risks of using the 'eval()' function in Node.js?

How can you securely store and verify passwords in a Node.js application?

How do you handle environment variables in Node.js?

Medium

What is CSRF and how do you protect a Node.js API against it?

How do you manage configuration in a Node.js application for different environments?

How do you manage sessions and authentication in a Node.js web application?

How does Node.js handle crypto operations efficiently without blocking the event loop?

What is Helmet and which HTTP security headers should a Node.js API set?

Explain how the 'crypto' module secures sensitive data in Node.js

Explain the differences between fork(), spawn(), and exec() in the child_process module.

How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

Hard

What is a ReDoS (Regular Expression Denial of Service) attack and how do you avoid it?

When would you use `child_process` module in Node.js?

What is SSRF and how do you mitigate it in a Node.js backend?

What is the 'vm' (Virtual Machine) module and when would you use it?

How do you secure your Node.js API endpoints?

What is prototype pollution and how do you prevent it in Node.js?

What is the Node.js permission model (--permission) and what does it protect against?