Top 30 Express Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   Why should the service layer in a layered Express API avoid referencing the request and response objects?

   • aServices run in a different thread from controllers
   • bExpress forbids accessing them outside route handlers
   • cPassing them is slower than passing plain values
   • dIt keeps business logic framework-agnostic and unit-testable without HTTP
   Show the answer

   Answer: d · It keeps business logic framework-agnostic and unit-testable without HTTP

   Keeping req and res out of services makes the business logic reusable and testable without spinning up HTTP. Express does not forbid it and services are not on a separate thread.

   Read the full bite: Layered structure for a scalable Express API

2. Question 2 of 30

   In classic Express 4, how should an error from an awaited database call inside async middleware reach the error handler?

   • aThrow it and let Express catch it automatically
   • bIgnore it, since unhandled rejections are routed by default
   • cCatch it and pass it to next(err) so the error-handling middleware runs
   • dCall res.send with the error directly from the middleware
   Show the answer

   Answer: c · Catch it and pass it to next(err) so the error-handling middleware runs

   Express 4 does not auto-catch async throws, so you must catch and forward with next(err) to trigger the four-argument error handler. Throwing alone leaves the request hanging.

   Read the full bite: Handling async errors in Express middleware

3. Question 3 of 30

   When using a .env file for local development, what is the most critical step to prevent accidental exposure of sensitive information?

   • aRegularly updating the values in the .env file to new, unique keys
   • bEncrypting the .env file with a strong password before use
   • cEnsuring the .env file is listed in your project's .gitignore
   • dStoring only non-sensitive configuration in the .env file
   Show the answer

   Answer: c · Ensuring the .env file is listed in your project's .gitignore

   The card explicitly states that 'The biggest mistake is committing your .env file to Git, exposing all your secrets' and that your '.gitignore file must contain a line with .env to prevent committing secrets.' This makes preventing version control exposure the most critical step. Storing only non-sensitive data (D) contradicts the primary purpose of .env for secrets.

   Read the full bite: Environment Variables: Config Outside Your Code

4. Question 4 of 30

   What is the primary characteristic that distinguishes the Service Layer from the Web Layer?

   • aIt handles all direct database interactions and data persistence.
   • bIt defines application routes and manages the request/response cycle.
   • cIt is responsible for validating incoming user input and sanitizing data.
   • dIt contains the core business logic, independent of HTTP specifics.
   Show the answer

   Answer: d · It contains the core business logic, independent of HTTP specifics.

   The card explicitly states the Service Layer "contains the core business logic, orchestrating tasks without knowing about HTTP," highlighting its independence from the web protocol. Option B describes the primary function of the Web Layer, which is concerned with HTTP requests and responses.

   Read the full bite: Structuring Express Apps with Layered Architecture

5. Question 5 of 30

   In a minimal Express app, what does omitting the app.listen call result in?

   • aThe server never binds to a port, so no requests are served
   • bExpress throws an error at startup demanding a port
   • cRoutes respond but on a random default port
   • dThe app serves only the root route and ignores others
   Show the answer

   Answer: a · The server never binds to a port, so no requests are served

   app.listen binds the server to a port; without it nothing accepts connections. Express does not pick a random port, throw automatically, or selectively serve routes.

   Read the full bite: Minimal Express Hello World server

6. Question 6 of 30

   Why is express.static(path.join(__dirname, 'public')) preferred over express.static('public')?

   • aOnly the absolute form enables HTTP caching headers
   • bThe absolute form serves files faster from disk
   • cA bare relative path resolves against the variable working directory and can break
   • dThe relative form exposes the public folder to directory traversal
   Show the answer

   Answer: c · A bare relative path resolves against the variable working directory and can break

   A relative path is resolved against the current working directory, which varies by launch context, so the absolute __dirname-based path is reliable. Both forms set caching headers and serve at the same speed.

   Read the full bite: Serving static files in Express

7. Question 7 of 30

   For the route app.get('/users/:id') hit by /users/42?active=true, which is correct?

   • areq.params.id is '42' and req.query.active is 'true'
   • bBoth id and active come from req.params
   • creq.query.id is '42' and req.params.active is 'true'
   • dBoth id and active come from req.query
   Show the answer

   Answer: a · req.params.id is '42' and req.query.active is 'true'

   Named path segments populate req.params and the query string populates req.query. The id is a route param and active is a query param, so the two objects are not interchangeable.

   Read the full bite: Query params vs route params in Express

8. Question 8 of 30

   Where must app.use(express.json()) be registered for req.body to be available in a POST handler?

   • aBefore the route handlers, so the body is parsed when they run
   • bInside each route handler that needs the body
   • cPosition does not matter because Express reorders middleware
   • dAfter the route handlers, so it can clean up the body
   Show the answer

   Answer: a · Before the route handlers, so the body is parsed when they run

   Middleware runs in registration order, so the parser must be mounted before the routes to populate req.body in time. Express does not reorder middleware, and registering it after the routes leaves req.body undefined.

   Read the full bite: Parsing JSON bodies with express.json

9. Question 9 of 30

   When returning data from a JSON API, why is res.json preferred over res.end for sending an object?

   • ares.end is deprecated and will be removed from Express
   • bres.json is faster because it skips serialization
   • cres.end cannot finalize a response without a status code
   • dres.json serializes the object and sets application/json, while res.end does neither
   Show the answer

   Answer: d · res.json serializes the object and sets application/json, while res.end does neither

   res.json stringifies the object and sets the JSON content type; res.end sends raw data with no serialization or content-type help. res.end is not deprecated, and res.json does serialize rather than skip it.

   Read the full bite: res.send vs res.json vs res.end

10. Question 10 of 30

    If app.get('/items/:id') is defined before app.get('/items/new'), what happens for a request to /items/new?

    • aBoth handlers run in sequence
    • bExpress returns a 404 due to the ambiguity
    • cExpress picks the literal /items/new because it is more specific
    • dThe /items/:id route matches first with id equal to 'new', shadowing the literal route
    Show the answer

    Answer: d · The /items/:id route matches first with id equal to 'new', shadowing the literal route

    Express matches in definition order with no specificity preference, so the earlier parameterized route captures 'new' as id. It does not auto-prefer the literal route, run both, or 404.

    Read the full bite: Express route order and matching

11. Question 11 of 30

    When mounting a router with app.use('/users', usersRouter), how should routes inside the router file be defined?

    • aWith the full path, like router.get('/users/:id')
    • bThey must repeat /users or the mount is ignored
    • cWith an absolute path including the host name
    • dRelative to the mount point, like router.get('/:id'), which resolves to /users/:id
    Show the answer

    Answer: d · Relative to the mount point, like router.get('/:id'), which resolves to /users/:id

    The mount prefix is prepended automatically, so routes are defined relative to it; router.get('/:id') becomes /users/:id. Repeating /users yields a doubled /users/users path.

    Read the full bite: Modularizing routes with express.Router

12. Question 12 of 30

    Why must auth middleware return after sending res.status(401) when the key is invalid?

    • aBecause res.status throws unless followed by return
    • bTo stop execution so it does not also call next and trigger a double response
    • cTo reset the response status back to 200
    • dTo free the API key from memory immediately
    Show the answer

    Answer: b · To stop execution so it does not also call next and trigger a double response

    Without returning, the function would continue and could call next, sending a second response and causing a headers-already-sent error. The return simply halts the handler; it does not free memory or reset status.

    Read the full bite: Custom API key auth middleware

13. Question 13 of 30

    What distinguishes an Express error-handling middleware from a regular one?

    • aIt has four parameters (err, req, res, next), and Express detects this signature
    • bIt must be named errorHandler
    • cIt is registered with app.error instead of app.use
    • dIt returns a Promise rejection instead of calling next
    Show the answer

    Answer: a · It has four parameters (err, req, res, next), and Express detects this signature

    Express identifies error handlers by their four-argument arity and routes errors to them. The name is irrelevant, there is no app.error method, and it is still registered with app.use.

    Read the full bite: Centralized error-handling middleware

14. Question 14 of 30

    In an Express middleware, what is the consequence of neither sending a response nor calling next?

    • aThe request hangs indefinitely because nothing advances or ends it
    • bExpress automatically calls next after a short delay
    • cExpress throws a synchronous error immediately
    • dThe next route handler runs anyway
    Show the answer

    Answer: a · The request hangs indefinitely because nothing advances or ends it

    A middleware must either end the response or call next; doing neither leaves the request stalled forever. Express does not auto-advance, run the next handler, or throw on its own.

    Read the full bite: What is Express middleware

15. Question 15 of 30

    A teammate posts JSON to your endpoint but req.body is undefined. The route is defined and the client sets Content-Type correctly. What is the most likely cause?

    • aexpress.json() was registered after the route definition
    • bJSON bodies require express.urlencoded() instead
    • cExpress cannot parse JSON without the body-parser package
    • dreq.body only works for GET requests
    Show the answer

    Answer: a · express.json() was registered after the route definition

    Middleware runs in registration order, so a parser added after the route never touches that request. body-parser is not required since express.json() is built in.

    Read the full bite: Parse JSON and URL-encoded bodies in Express

16. Question 16 of 30

    Your logging middleware prints correctly but every request to the server eventually times out with no response. What did the middleware most likely fail to do?

    • aCall next() to pass control to the next handler
    • bImport the console module
    • cReturn a Promise from the function
    • dSet a Content-Type header
    Show the answer

    Answer: a · Call next() to pass control to the next handler

    A middleware must either send a response or call next(); omitting next() leaves the request hanging. console is global and needs no import, and middleware need not return Promises.

    Read the full bite: Write a request-logging middleware in Express

17. Question 17 of 30

    You want authentication to apply only to routes under /admin without touching public routes. Which approach scopes it correctly?

    • aapp.use(requireAuth) at the top of the main app file
    • bPut requireAuth inside express.json()
    • cAdd requireAuth to every route via res.use()
    • drouter.use(requireAuth) on the admin Router, mounted at /admin
    Show the answer

    Answer: d · router.use(requireAuth) on the admin Router, mounted at /admin

    Router-level middleware on a Router mounted at /admin runs only for that group. A global app.use would protect every route, and res has no use() method.

    Read the full bite: Application-level vs router-level middleware

18. Question 18 of 30

    You wrote an error handler as (req, res, next) and errors passed via next(err) never reach it. What is the fix?

    • aWrap it in express.json()
    • bDeclare four parameters: (err, req, res, next)
    • cMove the handler to the very top of the app
    • dRename next to done
    Show the answer

    Answer: b · Declare four parameters: (err, req, res, next)

    Express identifies error handlers by their four-argument arity; three params make it a regular middleware that skips error propagation. Position alone does not fix the signature.

    Read the full bite: Express error-handling middleware signature

19. Question 19 of 30

    Auth middleware sets the current user so the route handler can use it. What is the correct, concurrency-safe place to store that user?

    • aOn the req object, e.g. req.user
    • bOn the res object's status code
    • cIn a module-level variable shared across requests
    • dIn a global process.env entry
    Show the answer

    Answer: a · On the req object, e.g. req.user

    req is unique per request and flows through the chain, so req.user is safe under concurrency. A shared module-level variable would leak one user's data into another simultaneous request.

    Read the full bite: Middleware execution order and sharing data via req

20. Question 20 of 30

    Your JWT middleware sends a 401 for bad tokens but crashes with 'Cannot set headers after they are sent'. What is the bug?

    • aIt uses jwt.verify instead of jwt.decode
    • bIt calls next() after sending the 401 response
    • cIt attaches the payload to req.user
    • dThe secret is read from an environment variable
    Show the answer

    Answer: b · It calls next() after sending the 401 response

    After responding you must return without calling next(), or the chain continues and a later handler tries to send again. verify (not decode) is exactly what you want for security.

    Read the full bite: Write a JWT authentication middleware

21. Question 21 of 30

    An Express application must verify that an email domain can accept mail before allowing signup. Which DNS method should it use?

    • adns.resolveMx because it directly queries nameservers for mail exchange records
    • bdns.lookupService because it maps the domain to its SMTP service endpoint
    • cdns.lookup because it returns the domain's IP address from the OS resolver
    • ddns.resolveTxt because it retrieves domain verification records required for email
    Show the answer

    Answer: a · dns.resolveMx because it directly queries nameservers for mail exchange records

    dns.resolveMx queries nameservers directly for MX records, which prove a domain is configured to receive mail, whereas dns.lookup only returns IP addresses via getaddrinfo and cannot verify mail configuration.

    Read the full bite: Node.js DNS: lookup vs. resolve

22. Question 22 of 30

    You want an XML parser to run only for application/xml requests, with the condition kept out of the parser's own code. Which is the cleanest approach?

    • aApply the XML parser globally to every request
    • bParse the body twice and discard the wrong result
    • cAdd an if-check on req.headers['content-type'] inside the parser
    • dUse express.text({ type: 'application/xml' }) or a wrapper that checks req.is() then delegates
    Show the answer

    Answer: d · Use express.text({ type: 'application/xml' }) or a wrapper that checks req.is() then delegates

    The type option and a req.is() wrapper keep the matching logic declarative and outside the parser, exactly what the question asks; embedding the check inside the parser is the disallowed approach.

    Read the full bite: Conditionally apply middleware by request property

23. Question 23 of 30

    What is the main advantage of using Express.js compared to Node.js's native HTTP module for building web servers?

    • aIt provides a complete solution for database integration and ORM.
    • bIt offers built-in support for real-time communication using WebSockets.
    • cIt automatically generates a structured project directory with separate files.
    • dIt simplifies the process of defining routes, applying middleware, and handling responses.
    Show the answer

    Answer: d · It simplifies the process of defining routes, applying middleware, and handling responses.

    The card states Express was created to simplify routing, middleware, and response handling, which are verbose with Node's native HTTP modules. Express itself is unopinionated about databases or project structure, and WebSocket support is not its primary advantage over native HTTP.

    Read the full bite: Creating Your First Express Server

24. Question 24 of 30

    Which combination correctly follows REST conventions for creating a new user?

    • aGET /createUser?name=Ada, read req.query, respond 200
    • bPUT /user, read req.body, respond 200
    • cPOST /users/create, read req.params, respond 204
    • dPOST /users, read fields from req.body, respond 201
    Show the answer

    Answer: d · POST /users, read fields from req.body, respond 201

    Creation uses POST against the plural collection /users, with input in the body and a 201 Created response. GET must be side-effect free and verbs do not belong in REST URLs.

    Read the full bite: Design an Express route to create a user

25. Question 25 of 30

    For GET /products/42?sort=price, where do the id 42 and the sort value come from respectively?

    • areq.params.id and req.body.sort
    • breq.params.id and req.query.sort
    • creq.body.id and req.query.sort
    • dreq.query.id and req.params.sort
    Show the answer

    Answer: b · req.params.id and req.query.sort

    42 is a named route segment captured in req.params, while sort=price is part of the query string in req.query. The body is empty on a typical GET.

    Read the full bite: req.params vs req.query vs req.body in Express

26. Question 26 of 30

    How does Express.js determine which specific handler function to execute for an incoming web request?

    • aBy executing the first handler function defined in the application, regardless of method or path.
    • bBy matching only the HTTP method of the request to a defined route.
    • cBy matching only the URL path of the request to a defined route.
    • dBy matching both the HTTP method and the URL path of the request.
    Show the answer

    Answer: d · By matching both the HTTP method and the URL path of the request.

    Express routing connects a request's path and HTTP method to a specific handler function. It requires both components to uniquely identify and execute the correct handler, as stated in the card: 'Each route matches a unique combination of an HTTP method and a URL path.' Options A and C are incomplete, as they only consider one part of the matching criteria. Option A describes a general execution order, not the specific matching logic for a route.

    Read the full bite: Express.js: Basic Request Routing

27. Question 27 of 30

    What is a critical pitfall to avoid when using the `res` object in an Express route handler?

    • aTrying to access client-sent data using `res.body` instead of `req.body`.
    • bSending multiple HTTP responses for a single client request.
    • cUsing `res.send()` to return a JavaScript object directly without stringifying it.
    • dForgetting to include `req` as the first parameter in the handler function.
    Show the answer

    Answer: b · Sending multiple HTTP responses for a single client request.

    The card explicitly warns against sending more than one response per request, as it closes the connection and leads to errors. While other options describe common mistakes, they are either syntax issues, misunderstandings of object roles, or not critical errors in the same way.

    Read the full bite: Express Request and Response Objects (req, res)

28. Question 28 of 30

    An API returns 200 OK for every successful response, including resource creation. What semantic information is being lost?

    • aThat a new resource was created, which 201 (with a Location header) signals
    • bThat the response is cacheable
    • cThat the request was authenticated
    • dThat the body is JSON
    Show the answer

    Answer: a · That a new resource was created, which 201 (with a Location header) signals

    201 Created communicates that a new resource now exists and where to find it via Location; a generic 200 hides that distinction. Auth, caching, and content type are conveyed by other mechanisms.

    Read the full bite: Status codes for successful POST and GET

29. Question 29 of 30

    You mount a products router with app.use('/products', router) and inside it write router.get('/products/:id', ...). Requests to /products/42 return 404. Why?

    • arouter.get only matches POST requests
    • bexpress.Router cannot take path parameters
    • cThe path becomes /products/products/:id because the mount prefix is added again
    • dThe router must be mounted with app.get not app.use
    Show the answer

    Answer: c · The path becomes /products/products/:id because the mount prefix is added again

    The mount path /products is prepended to each router path, so /products/:id inside the router resolves to /products/products/:id. Routes inside a router should be written relative to the mount point.

    Read the full bite: Modularize routes with express.Router

30. Question 30 of 30

    What is the consequence if an Express middleware function neither calls next() nor sends a response?

    • aThe client's request will hang indefinitely, awaiting a response.
    • bThe server terminates the connection with an internal server error.
    • cThe application automatically proceeds to the next middleware in the sequence.
    • dThe request is silently discarded, and the client receives no feedback.
    Show the answer

    Answer: a · The client's request will hang indefinitely, awaiting a response.

    The card states, "If a middleware does neither, the request hangs." This means the client will wait indefinitely for a response. Calling next() is explicitly required for the request to proceed to the next function in the chain, making option C incorrect.

    Read the full bite: Express Middleware: The Chain of Command for Requests