Intermediate everything in Backend Dev, page 10
Rust binary and library crates in one project
A binary crate has main and produces an executable; a library crate has lib.rs and is reusable; put logic in the lib and a thin main that calls it.
Explain multi-stage Docker builds for Python and builder vs runtime
Tests separation of build-time and runtime concerns. A strong answer contrasts the builder stage (gcc, headers, wheels) with the runtime stage (slim base, copied artifacts, no compiler). Red flag: citing size alone while ignoring security and caching.
How do you manage configuration and secrets for a containerized FastAPI app?
Tests 12-factor config separation and Docker secret hygiene. A strong answer uses pydantic-settings with runtime env vars, lru_cache, and keeps .env out of the image. Red flag: baking credentials into Dockerfile layers or committing .env files.
What are the key responsibilities for Nginx versus Uvicorn?
This tests the reverse-proxy versus ASGI-server boundary. A strong answer gives Nginx TLS termination, static files, buffering, and load balancing, while Uvicorn runs the Python app and async workers.
How do you authenticate a FastAPI WebSocket connection?
This tests WebSocket limits and FastAPI dependency injection. Pass the JWT via query parameter or cookie at handshake, validate it with Depends, and reject with HTTP 403 or 1008 close.
Use startup events to initialize a database pool and inject it
This tests FastAPI lifespan hooks and dependency injection for shared state. A strong answer creates the pool in an async startup handler, stores it on app.state, and accesses it via a dependency in routes. A red flag is creating a fresh pool per request.
How do you handle a WebSocket client disconnect in FastAPI?
Cite installing websockets, Handling disconnections and multiple clients pattern, and Depends.
How do you mark a FastAPI endpoint as deprecated?
This tests decorator-level OpenAPI configuration in FastAPI. Pass deprecated=True to the path operation decorator, e.g. @app.get("/old", deprecated=True), so Swagger UI shows a strikethrough. Red flag: burying a deprecation warning in the docstring instead.
How do you group FastAPI endpoints under tags and describe groups?
Tests FastAPI's two-step tag system: decorators label routes, and openapi_tags supplies group descriptions. Good answers cover tagging paths with tags=["users"], then defining metadata in FastAPI(openapi_tags=[...]) with matching names.
How can you provide a Swagger UI example for a Pydantic body?
Tests whether you know FastAPI generates OpenAPI schema from Pydantic metadata. A strong answer names Field(example=...) for per-field samples and Body(example=...) for the full payload.
How do you document multiple response schemas in OpenAPI?
This tests FastAPI OpenAPI schema generation for error responses. A strong answer covers the decorator responses dict mapping status codes to Pydantic models and descriptions, plus manually returning JSONResponse with that code.
How would you use pytest fixtures to manage TestClient and mock dependencies?
Tests FastAPI test isolation and dependency overrides. Strong answer: function-scoped fixture yielding TestClient, mock injection via app.dependency_overrides, and teardown cleanup to prevent state leaks.
How do you test a FastAPI endpoint without real tokens?
Tests whether you know FastAPI's dependency override mechanism to isolate business logic from auth. A great answer describes using app.dependency_overrides to swap the auth Depends for a mock returning a fake user, then cleaning up after the test.
Explain FastAPI dependency overrides with an in-memory SQLite test example
This tests FastAPI's hook for swapping dependencies cleanly in tests. A strong answer names app.dependency_overrides, defines a test-only in-memory SQLite session, and handles teardown. A red flag is patching globals or mocking ORM instead of dependency.
Which FastAPI CORSMiddleware parameters beyond allow_origins fix a PUT preflight?
Configure allow_methods for PUT and allow_headers for Authorization so the browser approves the cross-origin call.
Write a FastAPI middleware that adds X-Process-Time header
Tests FastAPI lifecycle and header mutation. Strong answers use the http middleware decorator, await call_next, compute elapsed time, and inject X-Process-Time before returning. Red flag: forgetting to await call_next or mutating headers after the return.
How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?
Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.
Implement RBAC in FastAPI with a JWT role dependency
Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends.
Implement OAuth2 Password Flow in FastAPI
Tests FastAPI security integration and stateless auth patterns. A strong answer covers the POST /token endpoint returning a JWT, the OAuth2PasswordBearer dependency, and get_current_user decoding the JWT sub.
Implement a PATCH endpoint for partial SQLAlchemy updates
Tests PATCH vs PUT and selective ORM updates. Strong answer: all-optional update schema, load existing record, iterate exclude_unset=True fields with setattr, commit. Red flag: updating without excluding unset, which overwrites missing fields with None.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles