Everything in Backend Dev, page 24
Async Path Operations in FastAPI
FastAPI path operations can be async, letting the server switch to other requests during I/O waits. Declare dependencies and sub-dependencies async when they await external calls.
Python Async Context Managers
Async context managers let you await during setup and teardown. Use async with for database connections or streams where acquiring and releasing both need I/O. The footgun is applying @contextmanager to async cleanup, which cannot await and will crash.
How does Node.js handle thousands of connections on one thread?
This tests non-blocking I/O: Node.js runs one thread for an event loop while the OS handles sockets via epoll or IOCP, resuming callbacks when data arrives. Mention the thread pool for DNS and fs work. A red flag is claiming threads spawn per request.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
Callback Hell: The Pyramid of Doom
Callback hell is what happens when nested async callbacks indent so deeply the code forms an unreadable pyramid. You see it in legacy Node.js when chaining database queries or file reads.
Node.js Built-in SQLite Driver
Node.js bundles a SQLite driver in node:sqlite. Open a file with new DatabaseSync(path), then run SQL with exec() or prepared statements. Use it for local tools and caches. DatabaseSync is synchronous, so running it on a web server main thread blocks requests.
ODM: Your Database as JavaScript Objects
ODM translates JavaScript objects to database records and back, letting you work with plain objects instead of raw queries. It removes boilerplate in Node.js apps but hides the real queries underneath.
Node.js DNS: lookup vs. resolve
Node.js splits DNS into two paths: dns.lookup uses getaddrinfo for IPs, while the dns.resolve family fetches records like MX or TXT. Use lookup for connections and the resolve family for service discovery.
Node.js Callbacks: Functions That Run Later
A callback is a function you pass to run later when an event fires or work finishes, keeping Node.js free to handle other work. HTTP servers use them to respond to connections without blocking.
npx: Execute Packages Without Installing Them
npx runs Node.js tools without installing them globally, fetching the latest version on demand. Use it for one-off scaffolding like create-react-app or CI build scripts. The footgun: it may silently run a stale cached copy if you omit a version tag.
Explain the performance overhead of a cgo call
Tests cgo transition penalties and scheduler semantics. A strong answer cites the ~100x overhead (~171ns vs ~1.8ns), notes C blocks an OS thread and starves the scheduler, and warns about memory copy taxes. Red flag: claiming cgo is free or ignoring blocking.
Why must FFI-bound structs use #[repr(C)] and what breaks without it?
Repr(C) fixes field order, size, alignment to C rules for extern calls; omitting it lets Rust reorder or pad fields, causing UB.
Use a C malloc'd char* in Go and Rust, then free it
Tests FFI allocator discipline. In Go, copy with C.GoString then C.free the *C.char. In Rust, read via CStr::from_ptr, copy to String, then libc::free. Red flag: letting Go GC or Rust Drop manage C memory, or using CString::from_raw on C malloc'd pointers.
Pass a string from Go and Rust to C safely
This tests FFI ownership and null-termination. In Go, use C.CString then C.free it. In Rust, create a std::ffi::CString, bind it to a let, then pass as_ptr while the binding lives. Red flag: claiming Rust is auto-safe without mentioning the temp-drop gotcha.
Purpose of Go import C and Rust equivalent mechanism
This tests FFI entry points: Go's import "C" activates cgo to reference C symbols directly, while Rust uses an unsafe extern "C" block to declare external functions. A red flag is calling either a normal import or omitting unsafe in Rust.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles