Node.js, APIs, and Security

Backend Node interviews judge whether you can ship reliable services—not recite framework trivia. Strong answers connect the request contract, runtime behavior, API design, network path, edge controls, and security boundaries to production failure modes.

This domain spans Node.js runtime and service fundamentals, backend frameworks (Express, NestJS, Fastify), API design (REST, GraphQL, realtime, RPC), HTTP and networking, Nginx/edge/gateway operations, and auth plus application security.

On interviews: trace one request from client through edge, framework, validation, auth, business logic, and persistence; name what blocks the event loop and where trust boundaries sit.

Common pitfalls: treating Node as magic async speed, designing APIs without versioning or error contracts, skipping validation at boundaries, and confusing authentication with authorization.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Tie every answer to request lifecycle and failure modes.
• Name runtime, framework, and edge responsibilities.
• Protect inputs, secrets, and auth boundaries.
• Plan shutdown, observability, and API evolution.