Express
85 bites tagged Express — interview questions with model answers, and 60-second explainers.
How does NODE_ENV=production change Express behavior?
NODE_ENV is a convention signal, production disables verbose logging and enables caching. understanding environment-specific optimizations and conventions.
How to add Socket.IO to an Express application?
Create HTTP server with express(), attach Socket.IO to it, listen on server not app, define event handlers. basic Socket.IO setup and HTTP server integration.
Unit testing Express auth middleware in isolation
Build fake req/res, use a spy/mock for next and res methods, assert next called on valid token and 401 sent on invalid. isolating and unit-testing middleware.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes. end-to-end JWT auth flow and storage tradeoffs.
Nested routes versus query params for related resources
Nested routes express ownership and scope clearly, query params on the flat resource are flexible for filtering and combining. REST relationship modeling tradeoffs.
Pinpointing validation errors in nested request data
Use schema validation that reports a path, collect all errors not just the first, return a 400 with field paths and messages. structured error reporting for nested input.
Validating request bodies with Express middleware
Run validation middleware before the handler, check email format and password length, return 400 with errors on failure, call next on success. separating validation from business logic via middleware.
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline. Real CSP rollout without unsafe-inline.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control. Knowing these are complementary, not interchangeable.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it… Understanding CSRF and the synchronizer-token pattern.
Preventing XSS when rendering user content in templates
The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data. Knowing XSS and contextual output encoding.
Purpose of Helmet middleware in Express
Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade. Awareness of HTTP security headers and defense in depth.
Mocking the database layer in Jest unit tests
A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes. Whether you isolate units from slow, stateful dependencies.
Integration testing a POST endpoint with Supertest
Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures. HTTP-level integration testing.
Custom Error classes and centralized handling
Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500. structured error design.
Reusable schema validation middleware with Zod or Joi
Define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success. schema-driven validation as middleware.
Propagating async errors to Express error handlers
Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically. async error forwarding.
Basic presence validation on a POST login route
Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed. minimal input validation.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes. layered authorization design.
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions. practical Passport.js wiring.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first. a core security vocabulary distinction.
API versioning: URL vs header strategies
Version via URL path (/v1/), a custom or Accept header, or a query param; URL is visible and cache-friendly, headers keep URLs clean but are less discoverable. managing breaking changes.
Centralized error handling in an Express API
A final four-arg error middleware, an asyncHandler wrapper to funnel promise rejections via next, a custom error class with statusCode, returning uniform JSON. designing one error path.
404 vs 500: missing resource vs server failure
A missing resource returns 404 Not Found (client asked for something absent); a database failure returns 500 Internal Server Error (server-side fault). 4xx versus 5xx semantics.
Get Express bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.