Interview Q&A / Node.js
Node.js interview questions
The event loop on the server, streams, modules and building APIs with Express.
Prefer rapid revision? Practise Node.js short interview answers →
- Is the payload of a JWT encrypted, and what should you not put in it?
No. The payload is only base64url encoded, so anyone holding the token can read it. Keep it small and non-sensitive: user id, role, expiry. Never put passwords, card details or personal secrets in it.
BeginnerQuick answer1 min read - What are the three parts of a JWT?
A JWT has a header (algorithm and type), a payload (claims such as user id and expiry), and a signature. They are base64url-encoded and joined with dots. The signature proves the token was not changed.
BeginnerQuick answer1 min read - What does npm audit do and how should you act on its results?
npm audit checks your dependency tree against a database of known vulnerabilities and reports severity and fixes. Use npm audit fix for safe upgrades, and review breaking or unreachable issues by hand.
BeginnerQuick answer1 min read - Why should you hash passwords with bcrypt instead of SHA-256 or storing them in plain text?
Plain text leaks everything in a breach. SHA-256 is designed to be fast, so attackers can test billions of guesses per second. bcrypt is deliberately slow, adds a unique salt, and its cost can be raised over time.
BeginnerQuick answer1 min read