More in Backend Dev — page 4
Offloading CPU work with worker_threads
WHAT IT TESTS: Keeping the event loop free during CPU-bound work. OUTLINE: Heavy sync work blocks the single event loop and stalls all requests; move it to a Worker, message the input, await the result asynchronously, and ideally pool workers.
Purpose of the Node.js cluster module
WHAT IT TESTS: Knowing Node is single-threaded per process and how to use all cores. OUTLINE: cluster forks worker processes sharing one listening port, so requests spread across CPU cores via the OS, raising throughput and adding resilience.
What is a Node.js Stream and why use one
WHAT IT TESTS: Understanding chunked processing and memory efficiency. OUTLINE: A stream processes data in chunks over time, so memory stays bounded and work starts before all data arrives; ideal for large files and network IO.
JWT storage: localStorage versus HttpOnly cookie
WHAT IT TESTS: Reasoning about XSS/CSRF trade-offs in token storage. OUTLINE: localStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Prototype pollution: how it works and prevention
WHAT IT TESTS: Deep JS object-model security. OUTLINE: Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Deploying a strict CSP for an Express SPA
WHAT IT TESTS: Real CSP rollout without unsafe-inline. OUTLINE: Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
Auditing and fixing vulnerable npm dependencies
WHAT IT TESTS: Practical dependency hygiene. OUTLINE: Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Input validation versus output encoding
WHAT IT TESTS: Knowing these are complementary, not interchangeable. OUTLINE: Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Preventing SQL injection with parameterized queries
WHAT IT TESTS: Knowing SQL injection and parameterization. OUTLINE: The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Explaining and preventing CSRF in Express
WHAT IT TESTS: Understanding CSRF and the synchronizer-token pattern. OUTLINE: CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Preventing XSS when rendering user content in templates
WHAT IT TESTS: Knowing XSS and contextual output encoding. OUTLINE: The risk is XSS; default to escaped interpolation (EJS <%= %>, Pug #{}) so HTML is encoded, and avoid raw output (<%- %>) for untrusted data.
Purpose of Helmet middleware in Express
WHAT IT TESTS: Awareness of HTTP security headers and defense in depth. OUTLINE: Helmet sets safe response headers like X-Content-Type-Options, HSTS, and CSP, mitigating MIME-sniffing, clickjacking, and protocol downgrade.
Testing an async workflow that spans DB and message queue
WHAT IT TESTS: Verifying side effects that finish after the HTTP response. OUTLINE: Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.
Testing code that calls a third-party API
WHAT IT TESTS: How you fake external HTTP without real network calls. OUTLINE: Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.
Managing clean test state across API integration tests
WHAT IT TESTS: How you keep integration tests isolated and fast. OUTLINE: Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Testing async Promise-returning code in Jest
WHAT IT TESTS: Whether you make async assertions actually run before the test ends. OUTLINE: Return or await the promise; use await expect(...).resolves/rejects, or await the value directly.
Mocking the database layer in Jest unit tests
WHAT IT TESTS: Whether you isolate units from slow, stateful dependencies. OUTLINE: A live DB makes tests slow, flaky, and order-dependent; use jest.mock on the model so methods return controlled fakes.
Integration testing a POST endpoint with Supertest
WHAT IT TESTS: HTTP-level integration testing. OUTLINE: pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.
Writing a basic Jest unit test
WHAT IT TESTS: Jest fundamentals. OUTLINE: import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.
Unit, integration, and E2E tests explained
WHAT IT TESTS: the test pyramid. OUTLINE: unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.