Everything in Node.js & Express, page 7
The three states of a JavaScript Promise
Pending, fulfilled, rejected; settle is one-way and final; create with the executor calling resolve or reject, consume with then and catch.
Monorepo workspaces vs private npm packages
Workspaces give atomic cross-service changes and instant local linking but couple release cadence; private packages give versioned isolation but add publish overhead and version drift.
Diamond dependencies and nested node_modules
Npm hoists one version to the top and nests the conflicting version under the dependent package; both coexist on disk.
Circular dependencies in CommonJS modules
When A requires B which requires A, the cache returns A's partial exports; fields defined later are undefined at that moment.
SemVer and the caret vs tilde range operators
MAJOR.MINOR.PATCH signals breaking/feature/fix; caret allows minor and patch updates, tilde allows only patch; use tilde for tighter control.
Layered structure for a scalable Express API
Routes map URLs, controllers handle HTTP, services hold business logic, data layer talks to the DB; keep each layer ignorant of HTTP except controllers.
Choosing between CommonJS and ES Modules
ESM is the standard with static import/export and top-level await; set type to module; CJS uses require and module.exports and is synchronous.
Why package-lock.json must be committed
Lockfile pins exact versions of the whole dependency tree including transitive deps; guarantees identical installs across machines and CI.
Resolving core vs relative module specifiers
'fs' is a built-in core module loaded by name with top priority; './my-file.js' is a relative path resolved from the current file.
dependencies vs devDependencies in package.json
Dependencies ship and run in production; devDependencies are only for development; omitted with npm install --production.
Offloading CPU-bound work with Worker Threads
Synchronous CPU work freezes the loop and all requests; offload to a Worker, communicate via messages or SharedArrayBuffer, use a pool.
nextTick vs setImmediate vs setTimeout(fn, 0)
NextTick is a microtask that drains before the loop continues; setImmediate runs in check; setTimeout(0) in timers.
Order of the Node.js event loop phases
Timers, pending callbacks, poll, check, close phases in order; I/O completion runs in poll.
The WebSocket Protocol
WebSocket (RFC 6455) is a protocol providing full-duplex, persistent communication over a single TCP connection. It begins as an HTTP request that upgrades, then both client and server can send messages anytime, enabling real-time apps without HTTP's…
How does Node.js handle thousands of connections on one thread?
This tests non-blocking I/O: Node.js runs one thread for an event loop while the OS handles sockets via epoll or IOCP, resuming callbacks when data arrives. Mention the thread pool for DNS and fs work. A red flag is claiming threads spawn per request.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles