Full Stack developer interview questions

Many fast unit tests, fewer API integration tests against a test database, and a thin set of end-to-end journeys such as login and checkout.

Drive the socket server with a client library in Node, emit events, and assert payloads and room membership.

Map broken access control to missing object-level checks, injection to Mongo operators and XSS, and security misconfig to default secrets and open CORS.

Prototype pollution writes to Object.prototype through unsanitized merge of user JSON.

Server-side request forgery tricks your API into fetching an attacker-chosen URL, such as cloud metadata.

Pin lockfiles, run npm audit in CI, and avoid installing unknown packages with huge dependency trees.

Authorize on the resource id, not only on being logged in, so user A cannot PATCH user B.

Use the Redis adapter so an emit on one process reaches sockets on others.

HTTP long-polling fallbacks and in-memory socket state expect the same client to hit the same process.

Ping/pong detects dead connections so the server can free rooms and the client can reconnect.

A stampede happens when a hot key expires and many Node processes hit MongoDB at once.

Cache-aside means the app reads Redis, and on miss loads the database and fills the cache.

Use predictable key names such as user:id:profile and delete them in the same service that writes.

Require passing CI, at least one review, and up-to-date branches so green checks match the latest commit.

The new version is deployed to a small subset of instances.

Redeploy the previous known-good artifact rather than hotfixing forward under pressure.

nginx handles certificates, HTTP/2, and cipher suites efficiently and keeps Node focused on application code.

keepalive reuses connections from nginx to Node, cutting handshake overhead.

A schema for required keys and URL formats fails fast if MONGO_URI or JWT_SECRET is missing.

Non-secret config such as LOG_LEVEL or FEATURE_CHECKOUT can live in committed example files and host env.