Nodejs
179 bites tagged Nodejs — interview questions with model answers, and 60-second explainers.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
ODM: Your Database as JavaScript Objects
ODM translates JavaScript objects to database records and back, letting you work with plain objects instead of raw queries. It removes boilerplate in Node.js apps but hides the real queries underneath.
Node.js DNS: lookup vs. resolve
Node.js splits DNS into two paths: dns.lookup uses getaddrinfo for IPs, while the dns.resolve family fetches records like MX or TXT. Use lookup for connections and the resolve family for service discovery.
npx: Execute Packages Without Installing Them
npx runs Node.js tools without installing them globally, fetching the latest version on demand. Use it for one-off scaffolding like create-react-app or CI build scripts. The footgun: it may silently run a stale cached copy if you omit a version tag.
Vite's Low-Level SSR API
Vite's SSR API lets you run Vite as a middleware inside your own Node.js server, giving you full control over rendering. It's for building custom SSR solutions, often with Express. The footgun: most apps should use a higher-level SSR plugin, not this API.
JWTs for Stateless API Authentication
JWTs enable stateless authentication: your server verifies users via a self-contained, signed token instead of a session store. This is ideal for distributed APIs. The biggest footgun is storing refresh tokens in localStorage; use HttpOnly cookies instead.
Passport.js: The Gatekeeper for Your Routes
Passport.js is a gatekeeper for your Node.js routes, authenticating requests before your application logic runs. It uses pluggable "strategies" for different login types, like local passwords or Google OAuth. The footgun is misconfiguring failure handling.
Cookie-Based Sessions: Server-Side State, Client-Side ID
Think of a session cookie as a coat check ticket, not the coat itself. The server stores your data and gives you a unique ID to carry in a cookie. This is how Express.js tracks user state across requests.
Never Trust Client Input: API Validation
Think of API validation as a bouncer for your server, checking every incoming request's ID before it can access your application logic. Use it in any Express route that accepts user input to prevent bad data from hitting your database or causing errors.
package-lock.json: Your Dependency Blueprint
package-lock.json is a blueprint for your node_modules, ensuring everyone on your team installs the exact same dependency versions. It's auto-generated by npm to prevent 'works on my machine' bugs. The footgun is ignoring it or manually editing it.
Docker Compose for Multi-Container Apps
Docker Compose is a conductor for your containers. Instead of running each service manually, you define your app and its database in one YAML file and launch them together. This is standard for local Node.js/Postgres development.
PM2: Zero-Downtime Reloads in Cluster Mode
PM2's `reload` command updates a clustered Node.js app without downtime by restarting processes one by one. Use this for live deployments. The footgun is using it on a stateful app, which will cause data loss unless state is externalized.
Health Check Endpoints: Reporting App Status
A health check is a dedicated endpoint that tells an orchestrator if your app is alive and ready for traffic. Systems like Kubernetes use it to decide whether to send traffic (readiness) or restart a container (liveness).
Optimize Node.js Images with Multi-Stage Builds
Multi-stage builds separate your build environment from your final runtime. This lets you use heavy tools to build your Node.js app, then ship only the lean production code, drastically reducing image size and attack surface.
PM2 Cluster Mode: Scale Node.js Across All Cores
PM2's cluster mode lets your Node.js app run on every CPU core, multiplying its capacity. It's essential for scaling networked apps on a single machine, but requires a stateless design—storing sessions in memory will break things as requests hit different…
Creating a Basic Node.js Dockerfile
A Dockerfile is a recipe for building a portable image of your app. Use it to ensure your Node.js app runs identically everywhere, from your laptop to production.
PM2: The Process Manager for Production Node.js
PM2 is a process manager that keeps your Node.js apps online. Use it to automatically restart crashed apps, run them in the background, and scale across CPU cores. The footgun is forgetting to run `pm2 save` to make your process list survive server reboots.
Socket.IO Adapters: Scaling Beyond One Server
Socket.IO adapters let you scale beyond one server. They use a backend like Redis Pub/Sub to broadcast messages across all your instances, so a user on Server A gets events from Server B. The footgun is assuming this handles everything; you still need a load.
Socket.IO Namespaces: Channels on One Connection
Socket.IO namespaces are virtual channels over a single WebSocket connection, letting you split app logic without multiple connections. Use them for separate areas like `/admin` or for multi-tenancy.
The 'ws' Library: WebSockets for Node.js Servers
The `ws` library is the standard for adding WebSocket servers to Node.js for real-time features like chat or live data feeds. It provides both server and client APIs for backend-to-backend communication.
Socket.IO Middleware: Your Connection Gatekeeper
Socket.IO middleware is a gatekeeper for new connections, running before a client is fully connected. It's ideal for authentication, rate limiting, or logging. The key footgun: you must always call `next()`, or the connection will hang until it times out.
Socket.IO Rooms: Broadcasting to Subsets of Clients
Think of Socket.IO Rooms as server-side channels for grouping clients. They let you broadcast messages to a specific subset, like a private chat or users following a topic. Remember rooms are a server-only concept; a client can't see which rooms it has joined.
Socket.IO: Broadcasting Events to Clients
Broadcasting sends a server-side event to multiple clients at once, like a public announcement system. Use it for live notifications or game state updates. The footgun: by default, it only reaches clients on the same server; use an adapter for multi-server…
Get Nodejs bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.