Interview Q&A / Node.js
Node.js interview questions
The event loop on the server, streams, modules and building APIs with Express.
Prefer rapid revision? Practise Node.js short interview answers →
- What is a refresh token and why use it alongside a short-lived access token?
The access token is short-lived (minutes) and sent on every request. The refresh token is long-lived, stored safely and used only to get a new access token. A stolen access token then expires quickly, and refresh tokens can be revoked.
IntermediateQuick answer1 min read - What is the difference between session-based authentication and JWT authentication?
Sessions store user state on the server and give the browser only a session id cookie. JWTs carry signed user claims in the token itself, so the server stores nothing, but revoking a token before it expires is harder.
IntermediateQuick answer1 min read - Where should a browser app store a JWT: localStorage or an httpOnly cookie?
An httpOnly, Secure, SameSite cookie keeps the token out of reach of JavaScript, so an XSS bug cannot steal it, but you must then handle CSRF. localStorage is simple but readable by any script on the page.
IntermediateQuick answer1 min read