Node.js & Express Interview Preparation

Backend interviews test whether you can build APIs, handle auth, and reason about server-side concerns — not just copy Express boilerplate.

What Interviewers Look For

REST API design
Middleware understanding
Authentication & security basics
Error handling and validation
Database integration patterns
How your project backend is structured

Files in This Section

File	Purpose
topics-not-to-miss.md	Must-know concepts checklist
interview-questions.md	30+ questions with full answers
auth-security.md	JWT, sessions, hashing, CORS
api-design.md	REST conventions and patterns
project-style-questions.md	15 scenario questions
common-mistakes.md	What students get wrong
revision-sheet.md	One-page cram before interview
mock-interview.md	45-minute practice flow

Study Order

topics-not-to-miss.md — identify gaps
api-design.md + auth-security.md — core backend literacy
interview-questions.md — 5 questions/day
project-style-questions.md — scenario practice
mock-interview.md — practice with a friend
revision-sheet.md — day before interview

Time Estimate

Minimum viable prep: 5–7 days
Solid prep: 2 weeks (with a small API project)

Project Connection

Be ready to explain: your API routes, auth flow, database schema, error handling, and one security decision you made.

Interactive

app.use(logger);app.use(auth);app.post('/orders', validate, handler);app.use(errorHandler);

requestloggerauthvalidatehandlererror mwresponse

📝 logged: POST /orders

POST /orders arrives. Middleware run IN REGISTRATION ORDER; each calls next() to pass the request on.

1 / 5

header (fixed)

{"alg":"HS256","typ":"JWT"}

payload — edit me

secret — the server's, never the client's

The signature covers exactly the bytes of header.payload. Change one character — by hand or with Tamper — and verification fails. Fix it by editing the payload pane instead: that re-signs with the secret, which an attacker doesn't have.

POST /login { user, pass }← 200 { token }GET /ordersAuthorization: Bearer <token>← 200 [ ...orders ]

clientcredentials →server

The client proves identity ONCE, with credentials.

1 / 4

Study materials