Intermediate everything in Node.js & Express, page 4
Choosing between CommonJS and ES Modules
ESM is the standard with static import/export and top-level await; set type to module; CJS uses require and module.exports and is synchronous.
Why package-lock.json must be committed
Lockfile pins exact versions of the whole dependency tree including transitive deps; guarantees identical installs across machines and CI.
Offloading CPU-bound work with Worker Threads
Synchronous CPU work freezes the loop and all requests; offload to a Worker, communicate via messages or SharedArrayBuffer, use a pool.
nextTick vs setImmediate vs setTimeout(fn, 0)
NextTick is a microtask that drains before the loop continues; setImmediate runs in check; setTimeout(0) in timers.
Order of the Node.js event loop phases
Timers, pending callbacks, poll, check, close phases in order; I/O completion runs in poll.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
Callback Hell: The Pyramid of Doom
Callback hell is what happens when nested async callbacks indent so deeply the code forms an unreadable pyramid. You see it in legacy Node.js when chaining database queries or file reads.
npx: Execute Packages Without Installing Them
npx runs Node.js tools without installing them globally, fetching the latest version on demand. Use it for one-off scaffolding like create-react-app or CI build scripts. The footgun: it may silently run a stale cached copy if you omit a version tag.
Production Secret Management: Inject, Don't Store
Treat secrets like temporary credentials, injected at runtime, not stored with your code. This applies to database passwords and API keys in production. The biggest footgun is using .env files; they are a dev convenience, not a security model.
Heap Snapshots: Finding Node.js Memory Leaks
A heap snapshot is a photograph of your app's memory. Use it to diagnose leaks by comparing snapshots over time to see which objects grow. The big footgun: taking one freezes your app and can double memory usage, risking a crash in production.
Sinon.JS: Isolate and Inspect Code for Unit Tests
Sinon.JS lets you replace real functions with test doubles to check *if* and *how* they were called. Use it to fake network requests or control timers. The biggest footgun is forgetting to restore fakes, which causes tests to leak state and fail unpredictably.
JWTs for Stateless API Authentication
JWTs enable stateless authentication: your server verifies users via a self-contained, signed token instead of a session store. This is ideal for distributed APIs. The biggest footgun is storing refresh tokens in localStorage; use HttpOnly cookies instead.
Passport.js: The Gatekeeper for Your Routes
Passport.js is a gatekeeper for your Node.js routes, authenticating requests before your application logic runs. It uses pluggable "strategies" for different login types, like local passwords or Google OAuth. The footgun is misconfiguring failure handling.
Cookie-Based Sessions: Server-Side State, Client-Side ID
Think of a session cookie as a coat check ticket, not the coat itself. The server stores your data and gives you a unique ID to carry in a cookie. This is how Express.js tracks user state across requests.
Never Trust Client Input: API Validation
Think of API validation as a bouncer for your server, checking every incoming request's ID before it can access your application logic. Use it in any Express route that accepts user input to prevent bad data from hitting your database or causing errors.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles