Interview Q&A / Node.js
Node.js interview questions
The event loop on the server, streams, modules and building APIs with Express.
Prefer rapid revision? Practise Node.js short interview answers →
- Is the payload of a JWT encrypted, and what should you not put in it?
No. The payload is only base64url encoded, so anyone holding the token can read it. Keep it small and non-sensitive: user id, role, expiry. Never put passwords, card details or personal secrets in it.
BeginnerQuick answer1 min read - What are the three parts of a JWT?
A JWT has a header (algorithm and type), a payload (claims such as user id and expiry), and a signature. They are base64url-encoded and joined with dots. The signature proves the token was not changed.
BeginnerQuick answer1 min read - Why should you hash passwords with bcrypt instead of SHA-256 or storing them in plain text?
Plain text leaks everything in a breach. SHA-256 is designed to be fast, so attackers can test billions of guesses per second. bcrypt is deliberately slow, adds a unique salt, and its cost can be raised over time.
BeginnerQuick answer1 min read - Write an Express middleware that checks a JWT and protects a route.
Read the Bearer token from the Authorization header, verify it with jwt.verify, attach the claims to req.user and call next. On a missing or invalid token, respond 401 without calling next.
BeginnerQuick answerCoding1 min read