Advanced interview questions in Backend Dev, page 5
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Split-brain, consensus, and quorum
Split-brain is two nodes both believing they are leader during a partition; Raft/Paxos require a majority quorum to elect a leader and commit, so the minority side cannot make progress.
Mitigating a database shard hot spot
Short-term, add read replicas or cache the hot keys; long-term, fix the partition key with hashing, salting, or finer-grained splitting.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens.
Network read/write timeouts in Go vs Rust stdlib
Go uses SetReadDeadline/SetWriteDeadline as absolute times; Rust uses set_read_timeout/set_write_timeout as durations on TcpStream.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Diagnosing degradation with normal CPU and memory
When CPU and memory look fine, sessions are waiting, not computing; examine wait statistics, lock and latch contention, I/O waits, and buffer pool hit ratio.
Cancellation: Go context vs Rust sync stdlib
Go's context.Context threads a Done channel and deadline through call chains; Rust std has no built-in cancellation, so you wire an AtomicBool or channel and check it.
What JWT claims must you validate beyond the signature?
This tests whether you understand token misuse beyond crypto: time validity, audience and issuer binding, algorithm whitelisting, and required claims enforcement. Red flag: only checking signature and ignoring exp or aud.
Defense-in-depth against SQL injection
Beyond parameterization, apply least-privilege accounts, stored procedures, input allowlisting, and monitoring to shrink blast radius.
Managing clean test state across API integration tests
Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Testing code that calls a third-party API
Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.
Unit of Work / Session pattern in ORMs
The Unit of Work tracks new, dirty, and deleted objects, then flushes them as one batched transaction at commit.
Diagnosing Go memory leaks with pprof heap profiles
Expose net/http/pprof, grab /debug/pprof/heap, analyze inuse_space for live retention versus alloc_space for cumulative allocation; rising inuse over time points to a leak.
Testing an async workflow that spans DB and message queue
Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.
Fixing an ORM's inefficient aggregation query
Drop to raw SQL or a view for the heavy report, or restructure the ORM query and add indexes. Raw SQL is fast but couples to the schema; tuning keeps portability.
Profiling a Rust hot loop with perf
Build with debuginfo, perf record cycles or cache-misses, perf report then perf annotate to map counters to source/asm; flamegraph for hotspots.
Why is FastAPI BackgroundTasks poor for multi-minute PDF generation?
Tests whether you know BackgroundTasks is same-process and for seconds, not minutes. Answer: propose a task queue with broker, workers, and result backend; return HTTP 202 with a job ID. Red flag: suggesting FastAPI workers instead of persistence and retries.
Design DB transaction middleware and identify the background-task pitfall
Tests request-scoped DB lifecycle awareness. Strong answer: middleware closes the session on response, yet BackgroundTasks run afterward, so sharing that session causes crashes or leaks. Red flag: saying background tasks can reuse the request transaction.
Compare Go and Rust approaches to exposing profiling data
Contrast Go's pprof import with Rust crates or profilers, noting runtime versus OS-level sampling.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles