Question 1

What is Node.js and why is it popular?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior Node knowledge assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The version numbers below were read directly from a running Node process on this machine, not quoted from memory. ## 1. Why This Even Matters — A Story First Before Node.js, JavaScript lived almost entirely in one place: the browser, running whatev

Question 2

What is the node:util parseArgs helper for building CLIs?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js CLI-tooling interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the successful parse and the strict-mode rejection below were **actually run** — real, structured output from a real CLI invocation, and a real thrown error, not descriptions of documented behavior. ## 1. Why This Even Matters — A Story First Reaching for a full-featu

Question 3

How do you handle environment variables in Node.js?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior configuration-management experience assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The string-coercion behavior below was **actually verified** on Node v24.19.0, not assumed from how JavaScript "usually" handles types. ## 1. Why This Even Matters — A Story First A form field that only accepts typed text will

Question 4

How would you implement caching in a Node.js application?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js system-design interviews — assumes familiarity with the performance-techniques question's real cache-timing proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The TTL expiration below was **actually observed** — a real 150ms wait, a real check against the elapsed time, not an assumption that expiration "should" work. ## 1. Why This Even M

Question 5

When would you choose Node.js over other backend technologies?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js system-design interviews — assumes familiarity with Node's concurrency model (see the dedicated question). **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. This is a judgment-and-trade-off question; the technical claims it rests on are grounded in real measurements verified in their own dedicated questions, cited here rather than re-derived. #

Question 6

What is Helmet and which HTTP security headers should a Node.js API set?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/Express security interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The header diff below is **real, measured** output from two actually-running Express servers — genuine response headers, not a description of what Helmet's documentation says it does. ## 1. Why This Even Matters — A Story First A house with no lock on the door, no pee

Question 7

Fastify vs Express — how do they differ in architecture and performance?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js backend interviews — assumes basic Express familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Section 3 is a **real Fastify 5.12.4 server, actually run** across five variations of the same schema — and running all five is what corrected a wrong first guess before it went into this doc. See the note there. ## 1. Why This Even Matters

Question 8

How do you validate and sanitize request input (zod / joi)?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js API-security and input-validation interviews — assumes familiarity with the prototype-pollution question's real attack proof. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the rejection and the field-stripping below were **actually run** with a real `zod` schema — genuine, specific validation issues, and a genuine, confirmed absence of

Question 9

What is SSRF and how do you mitigate it in a Node.js backend?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security interviews. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Both the attack and the mitigation below were **actually run** — a real internal service, a real leaked secret, and a real blocked request, not descriptions of intended behavior. ## 1. Why This Even Matters — A Story First A hotel guest cannot walk into the staff-only back of

Question 10

How do you secure your Node.js API endpoints?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js API-security system-design interviews — assumes familiarity with the individual topics this answer cross-links to. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The `helmet()` header comparison below was **actually run** against two real Express servers on Node v24.19.0. ## 1. Why This Even Matters — A Story First A building's real security

NODE.JSDECODED.

Easy