Intermediate everything in Backend Dev, page 3
Pinpointing validation errors in nested request data
Use schema validation that reports a path, collect all errors not just the first, return a 400 with field paths and messages.
Purpose of an ORM like Sequelize
Maps rows to objects, gives a model-based API, handles associations, migrations, and parameterized queries across dialects.
Validating request bodies with Express middleware
Run validation middleware before the handler, check email format and password length, return 400 with errors on failure, call next on success.
V8 generational GC and event loop responsiveness
Young-generation scavenges are frequent but short, old-generation major GC is rarer but longer, stop-the-world pauses block the single JS thread.
Detecting and diagnosing event loop lag
Measure delay between scheduled and actual timer fire, expose it as a metric, find synchronous CPU-bound code.
Microtask versus macrotask execution order in Node
NextTick drains before promises, both microtask queues flush fully between each macrotask, timers and setImmediate are macrotasks.
Role of libuv in the Node.js runtime
Libuv provides the event loop, a thread pool for blocking work, and OS async I/O abstractions.
Implementing a custom filtering Transform stream
Subclass Transform with objectMode, implement _transform to parse each chunk, push only matching objects, and call the callback; handle parse errors.
worker_threads versus cluster: when to use each
Worker_threads offloads CPU-bound compute within one process with shared-memory transfer; cluster forks processes to scale IO-bound request throughput across cores.
Offloading CPU work with worker_threads
Heavy sync work blocks the single event loop and stalls all requests; move it to a Worker, message the input, await the result asynchronously, and ideally pool workers.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Testing async Promise-returning code in Jest
Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.
Mocking the database layer in Jest unit tests
A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.
Integration testing a POST endpoint with Supertest
Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.
Operational versus programmer errors in Node.js
Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
Custom Error classes and centralized handling
Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.
Reusable schema validation middleware with Zod or Joi
Define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles