Advanced everything in Backend Dev, page 2
Managing clean test state across API integration tests
Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Strategies for revoking stateless JWTs
Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.
MongoDB aggregation pipeline for total sales
Explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending.
Atomic order creation with Sequelize transactions
Wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.
Solving the N+1 query problem in Sequelize
Define N+1 as one parent query plus one per child, detect it via SQL logging, fix with eager loading using include.
API versioning: URL vs header strategies
Version via URL path (/v1/), a custom or Accept header, or a query param; URL is visible and cache-friendly, headers keep URLs clean but are less discoverable.
Centralized error handling in an Express API
A final four-arg error middleware, an asyncHandler wrapper to funnel promise rejections via next, a custom error class with statusCode, returning uniform JSON.
Conditionally apply middleware by request property
Use express.text({ type: 'application/xml' }) or a guard wrapper that checks req.is() then calls the parser or next().
Write a JWT authentication middleware
Read the header, strip Bearer, jwt.verify with the secret, set req.user and next(), else send 401.
Centralized error-handling middleware
Error middleware takes four args err, req, res, next, is defined last, and runs when next(err) is called or sync errors throw.
Custom API key auth middleware
Read the header from req, on missing or invalid send res.status(401) and return, on valid call next, mount before protected routes.
Modularizing routes with express.Router
Create a Router instance in users.js, attach routes to it, export it, then mount it under a base path with app.use in the main file.
http.Agent and connection pooling
The agent pools and keeps sockets alive, avoiding repeated TCP and TLS handshakes, controlled by keepAlive and maxSockets.
Backpressure in Node.js streams
Backpressure pauses the readable when the writable buffer fills, pipe and pipeline manage it automatically, pipeline also propagates errors and cleans up.
Scaling across cores with cluster and os
Os.cpus gives core count, the primary forks one worker per core, all workers share the listening port, the OS load-balances connections.
Async iterators and for await...of for streaming
Async iterators yield values lazily over time; for await...of consumes them sequentially with backpressure, keeping memory bounded.
Promise.all vs Promise.allSettled
All rejects on the first failure; allSettled always fulfills with a status/value or reason per input. Use allSettled when partial success is acceptable.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles