Advanced concepts in Node.js & Express, page 2
Passport.js: The Generic OAuth2 Strategy
Passport's generic OAuth2 strategy is a template for social logins, not a plug-and-play solution. Use it to integrate a custom OAuth2 provider. The footgun is using it when a provider-specific strategy (like passport-github2) exists, which handles quirks for…
CSRF Tokens: Preventing Unwanted State Changes on Your Behalf
CSRF protection prevents a malicious site from forcing a user's browser to submit unwanted requests to your app. It adds a unique token to forms that the server validates. The footgun is failing to protect all state-changing endpoints, not just POST forms.
JWT Storage: Cookies (CSRF Risk) vs. Local Storage (XSS Risk)
Storing JWTs means choosing your risk: Cross-Site Request Forgery (CSRF) with cookies, or Cross-Site Scripting (XSS) with local storage. While local storage is simpler, HttpOnly cookies are generally safer as they can't be read by client-side scripts.
Node.js Uncaught Exceptions: Clean Up, Don't Continue
An uncaught exception is a fire alarm for your Node.js app, signaling an unknown state. Use the process.on('uncaughtException') hook for last-resort synchronous cleanup before exiting, not to resume normal operation.
E2E Testing: The Final Check, Not The Whole Strategy
E2E testing is a dress rehearsal for your app, simulating a full user journey. Use it sparingly for critical flows like checkout, as it tests all services together. The footgun is over-reliance: they are slow, brittle, and hard to debug.
Nock: Intercept and Mock Node.js HTTP Requests
Nock acts like a fake switchboard for your Node.js app's outgoing HTTP calls, redirecting them to pre-defined responses. This lets you unit test code that relies on external services, making tests fast, deterministic, and offline-capable.
SharedArrayBuffer: True Shared Memory for JS Threads
SharedArrayBuffer is a shared whiteboard for JS threads, letting them access the same memory without slow data copies. It's used for high-performance parallel tasks. The footgun: without Atomics to coordinate, you'll get race conditions and corrupted data.
V8's Garbage Collector: A Performance Pillar
V8's garbage collector is a key to its speed, using a "stop-the-world, generational, accurate" approach to reclaim memory. This runs automatically in Node.js and Chrome, but its pauses can impact performance.
Socket.IO Namespaces: Channels on One Connection
Socket.IO namespaces are virtual channels over a single WebSocket connection, letting you split app logic without multiple connections. Use them for separate areas like /admin or for multi-tenancy.
Socket.IO Adapters: Scaling Beyond One Server
Socket.IO adapters let you scale beyond one server. They use a backend like Redis Pub/Sub to broadcast messages across all your instances, so a user on Server A gets events from Server B. The footgun is assuming this handles everything; you still need a load.
Sticky Sessions: Pinning a User to a Server
Sticky sessions pin a user's requests to a single server in a multi-server setup. This is crucial for stateful apps like Socket.IO, where a user's session lives on one machine.
PM2: Zero-Downtime Reloads in Cluster Mode
PM2's reload command updates a clustered Node.js app without downtime by restarting processes one by one. Use this for live deployments. The footgun is using it on a stateful app, which will cause data loss unless state is externalized.
Docker Compose for Multi-Container Apps
Docker Compose is a conductor for your containers. Instead of running each service manually, you define your app and its database in one YAML file and launch them together. This is standard for local Node.js/Postgres development.
CI/CD Pipelines for Node.js Applications
A CI/CD pipeline is an automated assembly line for Node.js code, installing dependencies, running tests, and packaging your app for deployment. This is standard for any professional project, but a common footgun is not caching dependencies, leading to slow…
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles