Interview Q&A / Node.js

1. Is the payload of a JWT encrypted, and what should you not put in it?

   No. The payload is only base64url encoded, so anyone holding the token can read it. Keep it small and non-sensitive: user id, role, expiry. Never put passwords, card details or personal secrets in it.

   BeginnerQuick answer1 min read
2. What are the three parts of a JWT?

   A JWT has a header (algorithm and type), a payload (claims such as user id and expiry), and a signature. They are base64url-encoded and joined with dots. The signature proves the token was not changed.

   BeginnerQuick answer1 min read
3. What does npm audit do and how should you act on its results?

   npm audit checks your dependency tree against a database of known vulnerabilities and reports severity and fixes. Use npm audit fix for safe upgrades, and review breaking or unreachable issues by hand.

   BeginnerQuick answer1 min read
4. Why should you hash passwords with bcrypt instead of SHA-256 or storing them in plain text?

   Plain text leaks everything in a breach. SHA-256 is designed to be fast, so attackers can test billions of guesses per second. bcrypt is deliberately slow, adds a unique salt, and its cost can be raised over time.

   BeginnerQuick answer1 min read
5. What is CORS and how do you enable it safely in an Express API?

   CORS is a browser rule that blocks a page from reading responses from a different origin unless the server allows it with headers. In Express, use the cors package with an allow-list of origins, not a wildcard for private APIs.

   IntermediateQuick answer1 min read
6. Where should a browser app store a JWT: localStorage or an httpOnly cookie?

   An httpOnly, Secure, SameSite cookie keeps the token out of reach of JavaScript, so an XSS bug cannot steal it, but you must then handle CSRF. localStorage is simple but readable by any script on the page.

   IntermediateQuick answer1 min read