More in Backend Dev — page 24
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
Callback Hell: The Pyramid of Doom
Callback hell is what happens when nested async callbacks indent so deeply the code forms an unreadable pyramid. You see it in legacy Node.js when chaining database queries or file reads.
Node.js Built-in SQLite Driver
Node.js bundles a SQLite driver in node:sqlite. Open a file with new DatabaseSync(path), then run SQL with exec() or prepared statements. Use it for local tools and caches. DatabaseSync is synchronous, so running it on a web server main thread blocks requests.
ODM: Your Database as JavaScript Objects
ODM translates JavaScript objects to database records and back, letting you work with plain objects instead of raw queries. It removes boilerplate in Node.js apps but hides the real queries underneath.
Node.js DNS: lookup vs. resolve
Node.js splits DNS into two paths: dns.lookup uses getaddrinfo for IPs, while the dns.resolve family fetches records like MX or TXT. Use lookup for connections and the resolve family for service discovery.
Node.js Callbacks: Functions That Run Later
A callback is a function you pass to run later when an event fires or work finishes, keeping Node.js free to handle other work. HTTP servers use them to respond to connections without blocking.
npx: Execute Packages Without Installing Them
npx runs Node.js tools without installing them globally, fetching the latest version on demand. Use it for one-off scaffolding like create-react-app or CI build scripts. The footgun: it may silently run a stale cached copy if you omit a version tag.
Explain the performance overhead of a cgo call
Tests cgo transition penalties and scheduler semantics. A strong answer cites the ~100x overhead (~171ns vs ~1.8ns), notes C blocks an OS thread and starves the scheduler, and warns about memory copy taxes. Red flag: claiming cgo is free or ignoring blocking.
Why must FFI-bound structs use #[repr(C)] and what breaks without it?
WHAT IT TESTS: Rust ABI stability across FFI. ANSWER OUTLINE: repr(C) fixes field order, size, alignment to C rules for extern calls; omitting it lets Rust reorder or pad fields, causing UB. RED FLAG: Believing default layout is stable or repr(C) is optional.
Use a C malloc'd char* in Go and Rust, then free it
Tests FFI allocator discipline. In Go, copy with C.GoString then C.free the *C.char. In Rust, read via CStr::from_ptr, copy to String, then libc::free. Red flag: letting Go GC or Rust Drop manage C memory, or using CString::from_raw on C malloc'd pointers.
Pass a string from Go and Rust to C safely
This tests FFI ownership and null-termination. In Go, use C.CString then C.free it. In Rust, create a std::ffi::CString, bind it to a let, then pass as_ptr while the binding lives. Red flag: claiming Rust is auto-safe without mentioning the temp-drop gotcha.
Purpose of Go import C and Rust equivalent mechanism
This tests FFI entry points: Go's import "C" activates cgo to reference C symbols directly, while Rust uses an unsafe extern "C" block to declare external functions. A red flag is calling either a normal import or omitting unsafe in Rust.
Design a safe Rust wrapper taking &[i32] and returning Vec<i32>
Tests Rust FFI buffer-output encapsulation. A strong answer declares an unsafe extern C block, allocates a Vec with capacity, passes as_mut_ptr and a local size_t, validates returned length, then calls set_len.
Implement a custom derive macro for a Builder pattern
Tests proc-macro AST transformation. A strong answer lists: parse TokenStream with syn into DeriveInput, inspect fields, then quote builder code as TokenStream, noting the separate proc-macro crate. Red flag: treating tokens as strings instead of AST nodes.
What are Rust's three procedural macros and derive's advantage over macro_rules?
Tests Rust macros and AST generation vs text macros. Lists derive, attribute-like, and function-like macros, then explains derive needs AST introspection for per-field impl unreachable with macro_rules. Red flag: that macro_rules can iterate struct fields.
In Go's reflect package, what is settability and how is it obtained?
This tests whether you know reflection mutates only addressable storage. Settability means a Value points to actual memory; obtain it by calling reflect.ValueOf on a pointer then Elem, or on slice elements. Set panics when the Value is a copy, not an address.
Using reflect, iterate a pointer-to-struct's fields
Tests fluency with Go reflection for indirection and field traversal. Outline: ValueOf/TypeOf, guard IsValid, check Kind==Ptr, Elem to struct, loop NumField with Type for names and Value for values. Red flag: Field() on the pointer before Elem panics.
What does unsafe enable in Go and Rust? List two operations.
WHAT IT TESTS: Your grasp of where each language drops memory-safety guarantees. ANSWER OUTLINE: Go unsafe enables pointer arithmetic and type punning; Rust unsafe permits raw pointer dereferencing and FFI.
What are Rust's two macro categories and use cases?
WHAT IT TESTS: Whether you know Rust's declarative versus procedural macro distinction. ANSWER OUTLINE: Name macro_rules! for syntax like vec!, and procedural macros for custom derive on structs. RED FLAG: Calling them C-style substitution or runtime code.
What is go generate and how does it differ from make?
This tests whether go generate is a pre-build code generator, not a build system. Strong answers cover //go:generate directives, no dependency analysis, and committing generated files. A red flag is calling it a make replacement or an automatic build step.