Interview Q&A / Node.js

31. What is the difference between route parameters and query strings in Express?

    Route parameters are part of the path, like /users/42, and identify a specific resource, read from req.params. Query strings follow a question mark, like ?page=2, and filter or tweak a request, read from req.query.

    BeginnerQuick answer1 min read
32. Which HTTP status codes should a REST API return for create, validation errors, missing login and forbidden access?

    201 Created for a successful create, 400 for bad input (or 422 for failed validation), 401 when the user is not authenticated, 403 when authenticated but not allowed, 404 for a missing resource, and 500 for server faults.

    BeginnerQuick answer1 min read
33. Why does req.body come out undefined in Express, and what does express.json do?

    Express does not read request bodies by itself. express.json() is middleware that parses JSON bodies with a JSON content type and places the result on req.body. Without it, req.body is undefined.

    BeginnerQuick answer1 min read
34. Why does the order of middleware and routes matter in Express?

    Express runs middleware and routes in the order they are registered, and a response ends the chain. A parser placed after a route never runs for it, and a catch-all placed early swallows later routes.

    BeginnerQuick answer1 min read
35. Why should you hash passwords with bcrypt instead of SHA-256 or storing them in plain text?

    Plain text leaks everything in a breach. SHA-256 is designed to be fast, so attackers can test billions of guesses per second. bcrypt is deliberately slow, adds a unique salt, and its cost can be raised over time.

    BeginnerQuick answer1 min read
36. Why use path.join instead of joining file paths with plus signs?

    path.join uses the correct separator for the operating system, normalises extra slashes and dot segments, and avoids missing or doubled slashes, so paths work on Windows, Linux and macOS.

    BeginnerQuick answer1 min read
37. Write an Express middleware that checks a JWT and protects a route.

    Read the Bearer token from the Authorization header, verify it with jwt.verify, attach the claims to req.user and call next. On a missing or invalid token, respond 401 without calling next.

    BeginnerQuick answerCoding1 min read