Advanced everything in Node.js & Express
Multi-stage Docker builds for lean production images?
Build stage compiles/installs, runtime stage copies artifacts only, discards build tools.
Graceful shutdown implementation and zero-downtime deployments?
Listen for SIGTERM, stop accepting new connections, drain in-flight requests, close resources, exit.
WebSocket optimization for high-frequency data?
Large payloads increase latency, frequent tiny messages waste overhead, solutions include compression, selective fields, and batching.
Cross-server Socket.IO communication in horizontal scaling?
Local io.emit() only reaches local sockets, need adapter (Redis) for inter-server broadcast.
How do you handle errors across piped streams safely?
Pipe connects streams but errors don't auto-propagate, must listen on each stream. Use pipeline() helper for auto-cleanup.
postMessage vs SharedArrayBuffer in worker_threads tradeoffs?
Structured cloning copies data, SharedArrayBuffer shares memory.
How does Node.js cluster module enable zero-downtime restarts?
Master-worker architecture, graceful shutdown of old workers, routing new requests to new workers.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
Testing an async workflow that spans DB and message queue
Assert the DB row, then verify the queue message via a test consumer or spy, polling with a timeout rather than fixed sleeps.
Testing code that calls a third-party API
Intercept at the HTTP boundary (nock) or run a local mock server; cover success, errors, timeouts, and assert request shape.
Managing clean test state across API integration tests
Compare seed-and-truncate, per-test transaction rollback, and in-memory or containerized databases, weighing fidelity, speed, and isolation.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Strategies for revoking stateless JWTs
Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.
MongoDB aggregation pipeline for total sales
Explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending.
Atomic order creation with Sequelize transactions
Wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles