Intermediate everything in Backend Dev, page 11
Which FastAPI CORSMiddleware parameters beyond allow_origins fix a PUT preflight?
Configure allow_methods for PUT and allow_headers for Authorization so the browser approves the cross-origin call.
Write a FastAPI middleware that adds X-Process-Time header
Tests FastAPI lifecycle and header mutation. Strong answers use the http middleware decorator, await call_next, compute elapsed time, and inject X-Process-Time before returning. Red flag: forgetting to await call_next or mutating headers after the return.
How do OAuth2 scopes enable granular permissions in FastAPI versus role-based checks?
Tests OAuth2 scope granularity vs RBAC and FastAPI SecurityScopes. Strong answers mention JWT claim strings, SecurityScopes per endpoint, and that RBAC is coarse while scopes are fine-grained. Red flag: treating scopes as roles or skipping claim checks.
Implement RBAC in FastAPI with a JWT role dependency
Build a dependency that decodes the JWT, checks the role, raises 403 if not admin, and inject via Depends.
Implement OAuth2 Password Flow in FastAPI
Tests FastAPI security integration and stateless auth patterns. A strong answer covers the POST /token endpoint returning a JWT, the OAuth2PasswordBearer dependency, and get_current_user decoding the JWT sub.
Implement a PATCH endpoint for partial SQLAlchemy updates
Tests PATCH vs PUT and selective ORM updates. Strong answer: all-optional update schema, load existing record, iterate exclude_unset=True fields with setattr, commit. Red flag: updating without excluding unset, which overwrites missing fields with None.
Why synchronous DB libraries block async FastAPI endpoints and correct SQLAlchemy usage
This tests event loop blocking: sync DB calls in async def halt all requests. Answer: sync drivers block the loop despite releasing the GIL; use asyncpg with SQLAlchemy create_async_engine and AsyncSession. Red flag: recommending run_in_executor as default.
How do you use FastAPI dependency injection for database sessions?
Build a generator dependency that yields a session and closes it after; inject via Depends(get_db).
When should you use asyncio.Lock over threading.Lock?
This tests cooperative multitasking knowledge: asyncio.Lock yields to the event loop via await, while threading.Lock blocks the OS thread and freezes the loop. A red flag is claiming threading.Lock works because locks are universal.
Explain the asyncio event loop and cooperative multitasking
Tests if you view the event loop as a single-threaded orchestrator, not magic parallelism. Strong answers note it runs tasks and callbacks, manages a ready queue, and yields control at await. Red flag: calling it multithreading or parallel execution.
How do you safely execute blocking code from an async function
Tests whether you know how to prevent event loop blocking by offloading sync work. Name asyncio.to_thread or run_in_executor, explain ThreadPoolExecutor scheduling, and note when processes beat threads.
How do you apply a common path prefix across FastAPI routers?
Tests whether you know APIRouter decouples routes from path prefixes. Use relative paths in APIRouter, then mount with app.include_router(router, prefix="/api/v1"). This keeps modules reusable. Red flag: hardcoding the full absolute path in every decorator.
Manage dev, staging, and prod configs in a large FastAPI app
This tests separating environment config from code with pydantic-settings and env vars. A strong answer covers .env files for local dev, per-environment validation, and secret injection for prod. Red flags are hardcoded values or scattered conditionals.
How to apply a dependency to only one FastAPI router?
Pass dependencies=[Depends(auth)] to APIRouter for /users, omit it for /items, include both.
How does FastAPI cache dependencies within a single request?
Tests if you know FastAPI caches a dependency after the first call in a request and reuses it across the tree. A strong answer covers default use_cache=True, request-scoped lifetime, and disabling it.
How does FastAPI execute setup and teardown in nested yield dependencies?
It tests FastAPI's dependency injection lifecycle and stack-like teardown for nested yield dependencies. Setup runs top-down; teardown runs bottom-up after the response. A red flag is claiming teardown order is arbitrary or follows garbage collection.
How do you use a Python class as a FastAPI dependency?
It tests whether you understand FastAPI DI beyond functions and when stateful encapsulation wins. Explain that Depends takes callable classes, centralizing setup and shared state in __init__. Red flag: claiming classes are pure syntactic sugar.
How would you override a FastAPI dependency during testing?
Tests your grasp of FastAPI's dependency override mechanism. A strong answer mentions app.dependency_overrides, notes that sub-dependencies are bypassed, and stresses clearing overrides after each test.
How do you set a custom header and cookie in FastAPI?
Tests FastAPI temporal Response injection and merge behavior. Strong answer: inject Response, set headers via response.headers, cookies via set_cookie, then return the payload normally.
How do you create a reusable current-user dependency in FastAPI?
Tests DRY auth with FastAPI Depends. Answer: create get_current_user that Depends on OAuth2PasswordBearer, verifies token, returns User model, inject into routes. Red flag: middleware or manual header parsing in each endpoint.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles