Express interview questions and answers

Functions (req, res, next) that run in order for matching requests. Each can read or change the request and response, end the response, or call next() to pass control on. Logging, body parsing, authentication, CORS and compression are all middleware; route handlers are the last step. Order of app.use calls matters.

Error-handling middleware has four arguments (err, req, res, next) and is registered after routes. Calling next(err) skips to it. In Express 5, rejected promises from async handlers are passed to it automatically; in Express 4 you must catch and call next(err) yourself (or use a wrapper). Send safe messages to clients and log details.

Split routes by feature with express.Router(), keep handlers thin and move logic into services, put data access in repositories, centralise configuration, validation and error handling, and keep app creation separate from listen() so tests can import the app.

Use Helmet for security headers, configure CORS narrowly, validate and sanitise input (Zod, Joi, express-validator), use parameterised queries, rate-limit (express-rate-limit), authenticate with sessions or JWTs and authorise per route, limit body size, keep dependencies patched, and hide stack traces in production.

Validate body, params and query at the edge with a schema library (Zod, Joi or express-validator) in middleware, return 400 with clear field errors, and pass the parsed, typed data on (for example in res.locals). Never trust client input inside handlers.

Use a structured logger such as pino (pino-http) with a request ID per request (from a header or generated), log method, path, status and duration, propagate the ID to downstream calls and keep logs JSON so they can be searched.

Use the cors middleware with an allowlist of origins rather than * when credentials are involved, set allowed methods and headers, handle preflight OPTIONS requests, and remember CORS is enforced by browsers only; it is not server-side security.

Rejected promises in handlers and middleware go to error handling automatically, path matching uses a newer path-to-regexp with stricter syntax (named wildcards, no regex characters in strings), some deprecated methods were removed (for example res.send(status) forms, app.del), req.query is read-only, and Node 18+ is required.

app.use(path, fn) mounts middleware for all methods on paths starting with path. app.get(path, fn) handles GET requests on an exact route pattern. express.Router() is a mini-app with its own middleware and routes, mounted with app.use('/users', usersRouter).

express.json() for JSON and express.urlencoded({ extended: true }) for form posts, both built in, with size limits. File uploads need a multipart parser such as multer or busboy. Raw bodies (for webhook signatures) use express.raw() on that route.

Export the app without calling listen, and use Supertest to send requests (request(app).get('/users').expect(200)) in Jest or Vitest. Stub external services, and use a test database or transactions rolled back after each test.

Server sessions store state on the server (or Redis) and send a cookie with an ID; they are easy to revoke. JWTs are signed tokens holding claims, verified without a lookup; good across services but hard to revoke before expiry. For browser apps, httpOnly secure cookies are safer than storing tokens in localStorage.

Accept validated limit, cursor (or page) and filter parameters, cap the limit, query the database with indexes, and return items with a nextCursor and maybe a total. Cursor pagination stays stable as data changes.

Expose /healthz (liveness: the process is up) and /readyz (readiness: database and dependencies reachable) returning quick JSON responses, so load balancers and orchestrators route traffic only to healthy instances.

Helmet for headers, parameterised queries against SQL injection, output encoding against XSS, CSRF tokens or SameSite cookies for cookie-based auth, rate limiting against brute force, body size limits, and validating redirect targets.

Pipe a readable stream to res with stream.pipeline(source, res) so data flows with backpressure and errors are handled, set the right content headers, and avoid loading whole files into memory.

Mount routers per version (app.use('/v1', v1Router)), or use a header, keep old versions until clients migrate, and share services between versions so only the HTTP layer differs.

Limit file size and count, check MIME type and extension, store to disk or stream to object storage rather than memory for big files, generate your own file names, and scan or process files in a background job.

express.static('public', { maxAge: '1y', immutable: true }) serves files with cache headers; use hashed file names so long caching is safe. In production a CDN or reverse proxy usually serves them.

/users/:id exposes req.params.id; query strings appear in req.query. Both are strings, so validate and convert them. router.param can preload resources for a parameter.

Nginx or a cloud load balancer handles TLS, compression, static files, buffering slow clients and load balancing. Set app.set('trust proxy', ...) so req.ip and req.secure reflect the original client.

Wrap async handlers in a helper such as const wrap = fn => (req, res, next) => fn(req, res, next).catch(next), or use the express-async-errors package, so rejections reach the error middleware instead of becoming unhandled rejections.

Data scoped to the current request, available to later middleware and views, such as the authenticated user or validated input. It is reset for every request.

Use res.format({ json: () => ..., html: () => ... }) or check req.accepts('json') to send the representation the client asked for in the Accept header.

Add a final middleware after all routes that responds with 404 (or calls next with a NotFound error), placed before the error-handling middleware.

Use the cluster module or PM2 in cluster mode to run one process per CPU core sharing a port, or run one process per container and let the orchestrator scale replicas. Keep the app stateless so any instance can serve any request.

res.cookie(name, value, { httpOnly: true, secure: true, sameSite: 'lax', maxAge }) sets them; cookie-parser makes them available in req.cookies, and signed cookies use a secret to detect tampering.

Set a view engine (app.set('view engine', 'ejs') or Pug or Handlebars) and call res.render('page', data). Many modern apps use Express only as an API and render with a frontend framework instead.

Set server timeouts (server.requestTimeout, headersTimeout), add per-route timeouts with AbortController for downstream calls, and return 503 or 504 rather than hanging connections.

Express is minimal and has the largest ecosystem. Fastify is faster, schema-based and plugin-oriented. NestJS adds an opinionated architecture with DI on top of Express or Fastify. Choose by performance needs, team size and how much structure you want.

Hono is a small, fast framework built on Web standard Request and Response that runs on Node, Bun, Deno and edge runtimes. Express is Node-specific with the largest middleware ecosystem.

1. A(req, res, next)
2. B(err, req, res, next)Correct answer
3. C(err, next)
4. D(req, res)

Why: Four arguments mark it as an error handler.

1. AEnds the response
2. BPasses control to the next matching middlewareCorrect answer
3. CRestarts the server
4. DRetries the request

Why: next(err) jumps to error handlers.

1. AbodyParser.xml()
2. Bexpress.parse()
3. Capp.json()
4. Dexpress.json()Correct answer

Why: Built into Express 4.16+.

1. AIn middleware before the handlerCorrect answer
2. BIn the database only
3. CIn the browser only
4. DAfter sending the response

Why: Reject bad input at the edge.

1. APreflight uses OPTIONS
2. BOrigins can be allowlisted
3. CIt protects your server from all attackersCorrect answer
4. DBrowsers enforce it

Why: Non-browser clients ignore CORS.

1. Ares.json
2. Bstream.pipelineCorrect answer
3. Cres.send(stream)
4. Dfs.readFileSync

Why: Handles backpressure and errors.

1. AIs forwarded to error middlewareCorrect answer
2. BIs ignored
3. CReturns 200
4. DCrashes the server

Why: Express 5 handles async errors.

1. Acors
2. Bmorgan
3. Ccompression
4. DhelmetCorrect answer

Why: Helmet configures headers like CSP and HSTS.

1. Areq.query.id
2. Breq.params.idCorrect answer
3. Creq.body.id
4. Dres.locals.id

Why: Route parameters live in req.params.

1. APuppeteer
2. BPostman only
3. Ccurl
4. DSupertestCorrect answer

Why: It accepts the app object.

1. Aconsole.log
2. Balert
3. Cdebug only
4. DpinoCorrect answer

Why: JSON logs with pino-http.

1. AA 404 handler
2. BA static route
3. CThe root route
4. DA readiness checkCorrect answer

Why: Checks dependencies.

1. AInside each route
2. BAfter the error handler
3. CAfter all routes, before the error handlerCorrect answer
4. DFirst

Why: Order matters.

1. Asigned
2. BhttpOnlyCorrect answer
3. Csecure
4. DsameSite

Why: Protects against XSS theft.

1. ACompression
2. BParameterised queriesCorrect answer
3. CHelmet
4. DCORS

Why: Never concatenate input.

1. Aexpress.group()
2. Bnew Route()
3. Cexpress.Router()Correct answer
4. Dapp.module()

Why: Routers are mounted with app.use.

1. ADatabase pooling
2. Breq.ip and req.protocol behind a proxyCorrect answer
3. CStatic caching
4. DSession length

Why: It reads X-Forwarded-* headers.

1. Aexpress.files
2. Bexpress.serve
3. Cres.sendDir
4. Dexpress.staticCorrect answer

Why: express.static serves static assets.

1. AIt doesn't
2. BMiddleware runs in the order it is registeredCorrect answer
3. CExpress sorts it alphabetically
4. DOnly for errors

Why: Earlier middleware runs first.

1. Ares.formatCorrect answer
2. Bres.type only
3. Cres.negotiate
4. Dreq.format

Why: Content negotiation.

1. Alimits.fileSizeCorrect answer
2. Bdest
3. Cstorage only
4. DpreservePath

Why: Reject large files.

1. Aapp.use('/v1', v1Router)Correct answer
2. Bapp.version(1)
3. Crouter.v1()
4. Dapp.set('v', 1)

Why: One router per version.

1. Ares.template
2. Bres.html
3. Cres.renderCorrect answer
4. Dres.view

Why: Needs a view engine.

1. APM2 cluster modeCorrect answer
2. Bnodemon
3. Cnpm start
4. Dts-node

Why: Or the cluster module.

1. Ahelmet
2. Bcors
3. Cmulter
4. Dcookie-parserCorrect answer

Why: Also verifies signed cookies.

1. A301
2. B418
3. C504Correct answer
4. D200

Why: Gateway timeout.

1. AmulterCorrect answer
2. Bhelmet
3. Ccors
4. Ddotenv

Why: Multer parses multipart/form-data.

1. AmorganCorrect answer
2. Bnodemon
3. Clodash
4. Duuid

Why: Morgan is a request logger middleware.

1. Aapp.globals
2. Breq.session only
3. Cprocess.env
4. Dres.localsCorrect answer

Why: res.locals is scoped to the request.

1. AHonoCorrect answer
2. BExpress
3. CKoa only
4. DSails

Why: Node, Bun, Deno and edge.

1. AIt stays stable as data changesCorrect answer
2. BIt needs no index
3. CIt shows page numbers
4. DIt is shorter

Why: Offsets skip or repeat items.