Express.js Interview Questions

This lesson collects commonly asked Express.js interview questions with detailed answers, drawing on the concepts covered throughout this course.

How to Prepare With This Lesson

Interviewers ask Express.js questions to check whether you understand the middleware model deeply, not just whether you can list route methods. Focus on being able to explain *why* Express behaves the way it does, not just *what* the syntax looks like.

// A question like this tests understanding, not memorization:
app.use((req, res, next) => { console.log('A'); next(); });
app.get('/', (req, res) => { console.log('B'); res.send('done'); });
app.use((req, res, next) => { console.log('C'); next(); }); // never runs for GET /

// What logs for a GET / request, and why?

The answer: only 'A' and 'B' log, because res.send() ends the cycle before the third middleware is ever reached.

Question Categories

Core concepts       (middleware, routing, req/res)
Error handling       (sync vs async, centralized handlers)
Security             (CORS, headers, injection, auth)
Architecture         (layering, testing, scaling)

Expect a mix of conceptual questions and "what does this code do" trace-through questions.
Be ready to explain trade-offs, not just definitions, e.g. "session vs JWT" rather than just "what is JWT".
Practice explaining answers out loud, interviews reward clear communication as much as correct knowledge.

Quick-Fire Answers

Short, interview-ready answers to the most frequently asked questions.

Question	Short Answer
What is middleware?	A function with `(req, res, next)` that can modify the request/response or end the cycle
What makes error middleware special?	Its exact four-argument signature: `(err, req, res, next)`
Difference between PUT and PATCH?	PUT replaces the whole resource; PATCH updates part of it
Why does Express need express.json()?	It doesn't parse bodies by default; that middleware populates req.body
What does app.use() with no path do?	Runs the middleware for every request, regardless of path

Core Concept Questions

These questions test whether you understand what Express actually does under the hood, not just its surface syntax.

Explain the request-response cycle in Express, and what happens if no handler sends a response.
What is the difference between app.use() and app.get()?
How does express.Router() help organize a large application?
What is the difference between req.params, req.query, and req.body?

Architecture and Scaling Questions

Senior-level interviews often probe how you'd structure and scale a real Express application, not just individual routes.

How would you structure a large Express application?
How would you handle authentication across multiple server instances?
How would you scale an Express app across multiple CPU cores?
How would you add caching to a slow, frequently-hit endpoint?

Common Mistakes

Memorizing answers word-for-word instead of understanding the reasoning behind them.
Only preparing definitions and neglecting "trace through this code" style questions.
Not being able to explain trade-offs between similar approaches (sessions vs JWT, PUT vs PATCH).
Skipping practice on architecture and scaling questions, which are common in more senior interviews.

Key Takeaways

Express interviews test understanding of the middleware model, not just route syntax.
Be ready to trace through small code snippets and explain their exact output and order.
Practice explaining trade-offs between similar approaches, not just definitions.
Architecture and scaling questions become more common at senior levels.

Pro Tip

Practice explaining the middleware chain out loud with a concrete example, like the code snippet at the top of this lesson, interviewers frequently probe exactly this kind of execution-order reasoning.

Extended Express.js Interview Q&A

The following questions go deeper than the quick-fire table above, with fuller explanations for each answer.

1. What is middleware in Express, and what are the different types?

Middleware is any function with the signature (req, res, next) that sits in the request-handling pipeline. Express recognizes five categories: application-level (app.use()), router-level (router.use()), error-handling (four arguments, (err, req, res, next)), built-in (like express.json()), and third-party (like cors or helmet).

2. How does Express know a function is error-handling middleware?

Purely by arity, a function with exactly four parameters is treated as an error handler. A three-parameter function, even one intended to handle errors, is treated as regular middleware and will be skipped when next(err) is called.

3. Why doesn't req.body work without extra setup?

A request body arrives as a raw stream of bytes; Express does not parse it into a usable object automatically. You must register body-parsing middleware, most commonly express.json() or express.urlencoded(), before any route that reads req.body.

4. What happens if you don't call next() in a middleware function?

The request stalls indefinitely, Express has no automatic timeout or fallback. The client's connection eventually times out on its own, but the server never sends a response and no error is thrown, making this a notoriously silent bug to track down.

5. How do you handle errors inside an async route handler?

In Express 4, a rejected promise inside an async handler does not automatically reach your error-handling middleware. You must wrap the logic in a try/catch and call next(err), or use a small reusable wrapper function that catches rejected promises and forwards them automatically.

6. What's the difference between express.Router() and the main app object?

express.Router() creates a self-contained, mountable set of routes and middleware, essentially a mini application, but it has no listen() method and must be attached to a real app (or another router) with app.use(path, router) to actually receive requests.

7. How would you prevent SQL injection in an Express app using a SQL database?

Always use parameterized queries, ? placeholders in MySQL's mysql2, or $1, $2, ... placeholders in PostgreSQL's pg, instead of building SQL strings with concatenation or template literals containing raw request data.

8. What is the difference between authentication and authorization?

Authentication verifies who a user is, typically via credentials, a session, or a token. Authorization checks what an authenticated user is allowed to do, typically via roles or permissions. They are implemented as separate middleware, usually an authenticate step followed by an authorize(role) step.

9. Why is the default express-session MemoryStore unsuitable for production?

It never expires old sessions (a slow memory leak) and exists only within a single Node process, so it can't be shared across multiple server instances behind a load balancer, causing users to be randomly logged out depending on which instance handles their request.

10. How would you version a REST API built with Express?

The most common approach mounts a separate router tree under a version prefix, like app.use('/api/v1', v1Router) and app.use('/api/v2', v2Router), letting both versions run simultaneously while existing clients keep using the older one until they migrate.