Full Stack developer interview questions

Coverage only shows which lines ran, not whether assertions would catch a bug.

Cross-site request forgery tricks the browser into sending a victim's cookies to your API from another site.

If you pass untrusted JSON into a query, an attacker can send operators such as $gt and change the filter.

Use HTTPS-only cookies, HSTS, a Content-Security-Policy for the React app, X-Content-Type-Options, and a tight Referrer-Policy.

Rate-limit by IP and account, add backoff, and consider CAPTCHA after failures.

Mass assignment happens when the API saves every field the client sent, including role or isAdmin.

Socket.IO adds rooms, automatic reconnection, and fallbacks such as long polling.

Namespaces split the socket server into logical apps, such as /chat versus /notifications.

Send the access token in the handshake auth payload or a cookie and verify it before joining rooms.

Some proxies, firewalls, or old browsers block the WebSocket upgrade.

The API checks Redis for a key, returns the value on a hit, and on a miss loads MongoDB then writes Redis with a TTL.

Cache-Control tells browsers and CDNs how long a response may be reused.

TTL is how long a cached entry lives before it expires.

A CDN caches JS, CSS, and images at the edge so users download them from a nearby location.

On pull request you install, lint, test, and sometimes build the React app.

An artifact is the compiled output you ship, such as a Docker image or a React dist folder.

Use separate pipelines or separate jobs with different env secret sets.

A location block matches /api and proxy_pass to the upstream Node port.

try_files looks for a real file and otherwise returns index.html.

Configuration belongs in the environment, not in committed files.