Java and backend interview questions

Sessions need a shared store such as Redis once you have more than one app instance, or sticky load balancing which you should avoid.

localStorage is easy for XSS scripts to steal.

The access token is short-lived and sent on every API call.

XSS injects script into a page the user trusts and can steal tokens or act as the user.

The user is redirected to the identity provider, logs in, and the browser comes back with a short-lived code.

The app reads Redis first

A string GET/SET is simple for a blob you always read whole.

Invalidation messages get lost, deploys race, and some keys are never written again.

In-memory sessions die when the instance dies and they force sticky load balancing.

When a hot key expires, thousands of requests miss together and stampede the database.

Redis pub/sub is fire-and-forget: if a subscriber is down, the message is gone.

A topic is a named stream, like orders.

Each partition is assigned to at most one consumer in a group, so the group shares work.

At-most-once commits the offset before processing, so a crash can skip messages.

Kafka keeps a durable, replayable log so a new billing service can catch up from old offsets.

The key hashes to a partition, so all events for that user land in one ordered log.

Opening a TCP connection and authenticating to Postgres on every HTTP call is slow and will exhaust database max_connections.

HikariCP is the default JDBC pool.

Each request thread that hits the database needs a connection at the same time.

You load N parents with one query, then lazy-load each collection with one extra query, for N+1 round trips.