More in Backend Dev — page 5
Handling uncaughtException and unhandledRejection
WHAT IT TESTS: process-level last-resort error handling. OUTLINE: listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Operational versus programmer errors in Node.js
WHAT IT TESTS: error classification and recovery policy. OUTLINE: operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
Custom Error classes and centralized handling
WHAT IT TESTS: structured error design. OUTLINE: custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.
Reusable schema validation middleware with Zod or Joi
WHAT IT TESTS: schema-driven validation as middleware. OUTLINE: define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success.
Propagating async errors to Express error handlers
WHAT IT TESTS: async error forwarding. OUTLINE: Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically.
Basic presence validation on a POST login route
WHAT IT TESTS: minimal input validation. OUTLINE: ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.
JWT storage: localStorage versus httpOnly cookies
WHAT IT TESTS: client-side token storage threats. OUTLINE: localStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Strategies for revoking stateless JWTs
WHAT IT TESTS: JWT revocation trade-offs. OUTLINE: short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.
Role-based access control middleware in Express
WHAT IT TESTS: layered authorization design. OUTLINE: authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.
Securing Express with Passport local strategy
WHAT IT TESTS: practical Passport.js wiring. OUTLINE: configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions.
Session-based versus token-based authentication
WHAT IT TESTS: auth architecture trade-offs. OUTLINE: sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services.
JWT structure and how the signature works
WHAT IT TESTS: understanding of JWT anatomy. OUTLINE: name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering.
Authentication versus authorization in Express
WHAT IT TESTS: a core security vocabulary distinction. OUTLINE: authentication proves who you are, authorization decides what you may do, authentication happens first.
MongoDB aggregation pipeline for total sales
WHAT IT TESTS: knowledge of aggregation stages. OUTLINE: explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending. RED FLAG: trying to filter the sum with $match before $group.
Atomic order creation with Sequelize transactions
WHAT IT TESTS: atomicity and transaction handling. OUTLINE: wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.
Solving the N+1 query problem in Sequelize
WHAT IT TESTS: ORM performance awareness. OUTLINE: define N+1 as one parent query plus one per child, detect it via SQL logging, fix with eager loading using include. RED FLAG: looping over results and querying associations individually.
Mongoose pre('save') hooks for password hashing
WHAT IT TESTS: lifecycle hooks on documents. OUTLINE: pre('save') runs before persistence; use it to hash the password, guarding with isModified, calling next() or returning.
Database migrations with the Sequelize CLI
WHAT IT TESTS: versioned, repeatable schema changes. OUTLINE: migrations are version-controlled scripts with up/down so teams apply identical schema changes; use sequelize-cli to generate, edit with addColumn, then db:migrate.
Mongoose populate() for referenced documents
WHAT IT TESTS: resolving references across collections. OUTLINE: populate() replaces stored ObjectIds with the referenced documents, needs a ref in the schema, called via .populate('author').
Define a Mongoose schema and model
WHAT IT TESTS: schema syntax and the schema-to-model step. OUTLINE: new mongoose.Schema with field options (type, required, default), then mongoose.model('Product', schema) to get a model.