Interview Q&A / Node.js

61. What is a refresh token and why use it alongside a short-lived access token?

    The access token is short-lived (minutes) and sent on every request. The refresh token is long-lived, stored safely and used only to get a new access token. A stolen access token then expires quickly, and refresh tokens can be revoked.

    IntermediateQuick answer1 min read
62. What is backpressure in Node.js streams?

    Backpressure is when a writable cannot consume data as fast as a readable produces it. The writable signals this, and the reader should pause, otherwise memory fills up with unwritten data.

    IntermediateQuick answer1 min read
63. What is CORS and how do you enable it safely in an Express API?

    CORS is a browser rule that blocks a page from reading responses from a different origin unless the server allows it with headers. In Express, use the cors package with an allow-list of origins, not a wildcard for private APIs.

    IntermediateQuick answer1 min read
64. What is the difference between session-based authentication and JWT authentication?

    Sessions store user state on the server and give the browser only a session id cookie. JWTs carry signed user claims in the token itself, so the server stores nothing, but revoking a token before it expires is harder.

    IntermediateQuick answer1 min read
65. What is the difference between stream.pipe and stream.pipeline?

    pipe connects streams but does not forward errors or clean up, so a failure can leave streams open. pipeline connects several streams, destroys all of them on error, and reports the result in one callback or promise.

    IntermediateQuick answer1 min read
66. What is top-level await and where can you use it in Node.js?

    It lets you use await directly at the top of a file without wrapping it in an async function. It works only in ES modules, and it delays anything that imports that module until the promise settles.

    IntermediateQuick answer1 min read
67. Where should a browser app store a JWT: localStorage or an httpOnly cookie?

    An httpOnly, Secure, SameSite cookie keeps the token out of reach of JavaScript, so an XSS bug cannot steal it, but you must then handle CSRF. localStorage is simple but readable by any script on the page.

    IntermediateQuick answer1 min read
68. Write a Transform stream that converts incoming text to uppercase.

    Extend stream.Transform (or pass a transform function), call this.push with the changed chunk, and call the callback when done. Then pipe a readable into it and into a writable.

    IntermediateQuick answerCoding1 min read