Express JS Advanced
Interview Questions with Answers

21. How do you create a centralized error-handling mechanism in Express?

Add a single error middleware at the very end of your middleware chain to format and send all errors consistently. Send safe messages to clients and log full details on the server.

// routes
app.get('/boom', (req, res) => { throw new Error('Kaboom'); });
// 404 handler goes before error handler (see Q23)
app.use((req, res) => res.status(404).json({ error: 'Not Found' }));
// centralized error handler (last)
app.use((err, req, res, next) => {
  const status = err.status || err.statusCode || 500;
  const code   = err.code || 'INTERNAL_ERROR';
  const message = process.env.NODE_ENV === 'production' ? 'Internal Server Error' : err.message;
  // log richly here (req id, user, stack)
  res.status(status).json({ error: { code, message } });
});

Wrap async handlers so thrown/rejected errors reach this middleware:

const asyncH = fn => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);

22. What is the difference between synchronous and asynchronous error handling in Express?

Synchronous errors thrown inside a handler are caught by Express automatically and passed to the error middleware. Asynchronous errors must be forwarded explicitly with next(err) or by using an async wrapper so unhandled promise rejections don’t crash the process.

// sync: throw works
app.get('/sync', (req, res) => { throw new Error('sync'); });
// async: use wrapper
app.get('/async', asyncH(async (req, res) => {
  const data = await risky(); // if this rejects, asyncH -> next(err)
  res.json(data);
}));

23. How do you handle 404 errors globally in Express?

Place a “catch-all” middleware after all routes but before the error middleware.

app.use((req, res) => {
  res.status(404).json({ error: 'Not Found' });
});

This runs only if no prior route matched.

24. How do you customize error messages per environment (dev vs prod)?

Use NODE_ENV to control the response surface. In production, avoid leaking stack traces; in development, include them for debugging.

app.use((err, req, res, next) => {
  const status = err.status || 500;
  const payload = {
    error: {
      message: process.env.NODE_ENV === 'production' ? 'Internal Server Error' : err.message,
      ...(process.env.NODE_ENV !== 'production' && { stack: err.stack })
    }
  };
  res.status(status).json(payload);
});

25. How do you propagate custom errors through middleware?

Define a custom error class with status/statusCode/code fields. When something fails, return next(new AppError(‘Bad input’, 400, ‘BAD_INPUT’)).

class AppError extends Error {
  constructor(message, status = 500, code = 'INTERNAL_ERROR') {
    super(message); this.status = status; this.code = code;
  }
}
app.get('/users/:id', asyncH(async (req, res, next) => {
  if (!/^\d+$/.test(req.params.id)) throw new AppError('Invalid ID', 400, 'INVALID_ID');
  const user = await repo.findById(req.params.id);
  if (!user) throw new AppError('User not found', 404, 'NOT_FOUND');
  res.json(user);
}));

// centralized handler from Q21 handles AppError nicely

26. How do you enable Gzip compression in Express?

Use the compression middleware to automatically compress responses that benefit from it. Place it early, but after things that modify the body.

// npm i compression
const compression = require('compression');
app.use(compression({ threshold: 1024 })); // only compress >1KB bodies

Also ensure upstream proxies (NGINX/CloudFront) handle compression for static assets.

27. How do you implement caching at the route level in Express?

Combine HTTP cache headers with a server-side cache for expensive endpoints.

HTTP caching:

app.get('/public-feed', (req, res) => {
  res.set('Cache-Control', 'public, max-age=60, stale-while-revalidate=120');
  res.json(feedData);
});

ETag/conditional requests:

app.set('etag', 'strong'); // default is weak
// Express auto-sends ETag; if If-None-Match matches, it will 304 automatically.
Server-side cache (e.g., Redis) for computed responses:
// pseudo: cache -> compute -> cache set
app.get('/stats', cache.get, asyncH(async (req, res) => {
  const result = await heavyCompute();
  await cache.set(req.originalUrl, result, 60);
  res.json(result);
}));

Always add cache busting on data that changes, and vary keys by params/auth where needed.

28. How does clustering improve Express performance?

Node runs a single event loop per process. Clustering starts multiple worker processes (one per CPU core) to utilize multicore machines and improve throughput and resilience (a worker crash doesn’t kill the master).

// basic cluster setup
const cluster = require('cluster');
const os = require('os');
if (cluster.isPrimary) {
  os.cpus().forEach(() => cluster.fork());
  cluster.on('exit', () => cluster.fork()); // respawn
} else {
  app.listen(process.env.PORT || 3000);
}

In production, use a process manager like PM2 (pm2 start app.js -i max) for clustering, logs, and graceful reloads.

29. How do you use load balancers effectively with Express?

Place a reverse proxy/load balancer (NGINX, HAProxy, ALB) in front of multiple app instances. Configure:

• Health checks on a lightweight /health route returning 200 fast.
• Keep-alive and connection pooling to reduce handshake overhead.
• Timeouts that are strict but realistic; set Express server.headersTimeout thoughtfully for slow clients.
• Compression and TLS termination at the proxy when appropriate.
• Sticky sessions if you use in-memory sessions; better is a shared session store so you can avoid stickiness.
• Trust proxy in Express so req.ip, secure cookies, and protocol detection work correctly:

app.set('trust proxy', 1);

30. How do you minimize memory leaks in an Express app?

Adopt defensive patterns and monitor memory:

• Avoid unbounded in-memory caches; use LRU caches with size limits or Redis.
• Clean up timers, intervals, and event listeners; ensure req.on(‘close’) handlers remove subscriptions.
• Stream large files instead of buffering; use stream.pipeline() to auto-cleanup on error.
• Reuse DB connections with pools; close cursors/streams.
• Ensure every middleware either sends a response or calls next(); hung requests can accumulate.
• Use profiling tools: clinic heapprof, Chrome DevTools heap snapshots, or node –inspect.
• Watch for hot object maps keyed by untrusted input (memory growth over time).
• In production, run under a supervisor (PM2) with clustering so leaks in one worker don’t take down the entire service; use rolling restarts with graceful shutdowns:

const server = app.listen(PORT);
process.on('SIGTERM', () => server.close(() => process.exit(0)));

31. How do you prevent Cross-Site Scripting (XSS) in Express?

Use a layered approach: escape output in templates, avoid injecting untrusted HTML, enforce a strict Content Security Policy (CSP), and sanitize any user-supplied HTML.

• Prefer res.json() over building HTML strings.
• In templates, use auto-escaping helpers (e.g., Handlebars/EJS default escapes).
• Add CSP to block inline scripts and restrict sources.
• If you must render user HTML, sanitize it on the server with a library (e.g., sanitize-html) and on the client with DOMPurify.
• Never use eval, Function, or dangerously set innerHTML with untrusted input.

const helmet = require('helmet');
app.use(helmet.contentSecurityPolicy({
  useDefaults: true,
  directives: {
    'script-src': ["'self'"],      // add hashes/nonces if you have inline scripts
    'object-src': ["'none'"],
    'base-uri': ["'self'"]
  }
}));

32. How do you protect Express apps from CSRF attacks?

Require a per-request CSRF token for state-changing actions, ensure cookies are properly scoped, and validate Origin/Referer on sensitive routes.

• Use csurf to generate and validate tokens stored in a cookie or session.
• Mark auth cookies SameSite=Lax or SameSite=None; Secure (if cross-site), and HttpOnly.
• For API-only backends used by SPAs, prefer Authorization headers (Bearer tokens). If you still store tokens in cookies, you must use CSRF tokens.

// npm i csurf cookie-parser
const cookieParser = require('cookie-parser');
const csurf = require('csurf');
app.use(cookieParser());
app.use(csurf({ cookie: { httpOnly: true, sameSite: 'lax', secure: process.env.NODE_ENV==='production' }}));
app.get('/form', (req, res) => res.json({ csrfToken: req.csrfToken() }));
app.post('/transfer', (req, res) => res.send('ok')); // token must be sent back

33. How does Helmet.js improve Express security?

Helmet sets HTTP headers that mitigate common attacks: CSP to control script loading, HSTS to force HTTPS, X-Frame-Options/frameguard to prevent clickjacking, X-Content-Type-Options: nosniff to stop MIME sniffing, Referrer-Policy, Cross-Origin-Resource-Policy, and more. Configure it early in your middleware chain and tailor directives to your app.

const helmet = require('helmet');
app.use(helmet()); // sensible defaults
app.use(helmet.hsts({ maxAge: 15552000, includeSubDomains: true, preload: true })); // HTTPS only

34. How do you secure cookies in Express applications?

Set the right flags and scope:

• HttpOnly: true so JS can’t read them.
• Secure: true in production so they’re sent only over HTTPS.
• SameSite: ‘lax’ for most apps; use ‘none’ (with Secure) only if you truly need cross-site cookies.
• Use short maxAge and narrow path/domain.
• Sign cookies if you need tamper detection.

res.cookie('sid', sessionId, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'lax',
  path: '/',
  maxAge: 1000 * 60 * 60
});

35. How do you prevent brute-force login attempts in Express?

Rate-limit login and OTP endpoints, add incremental backoff per user/IP, and use strong password hashing.

• express-rate-limit for request caps.
• Combine keys (IP + username/email) to avoid easy bypass.
• Lock out or require CAPTCHA after too many failures.
• Hash passwords with Argon2 or bcrypt (slow, salted).
• Log and alert on spikes.

// npm i express-rate-limit
const rateLimit = require('express-rate-limit');
const loginLimiter = rateLimit({
  windowMs: 15*60*1000,
  max: 10,
  standardHeaders: true,
  legacyHeaders: false
});
app.post('/auth/login', loginLimiter, loginHandler);

36. How do you implement JWT authentication in Express?

Issue a short-lived access token after verifying credentials; verify it on protected routes. Prefer HS256 with a strong secret or RS256 with key rotation. Validate exp, aud, and iss. Send tokens via Authorization: Bearer header or an HttpOnly cookie if you’re protecting against XSS well and also handling CSRF.

// npm i jsonwebtoken
const jwt = require('jsonwebtoken');
const ACCESS_TTL = '15m';
app.post('/auth/login', async (req, res) => {
  const user = await authRepo.verify(req.body.email, req.body.password);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
  const token = jwt.sign({ sub: user.id, role: user.role }, process.env.JWT_SECRET, {
    expiresIn: ACCESS_TTL,
    issuer: 'your-app',
    audience: 'your-frontend'
  });
  res.json({ accessToken: token });
});
// protect routes
function requireAuth(req, res, next) {
  const token = (req.headers.authorization || '').replace(/^Bearer /, '');
  try {
    const payload = jwt.verify(token, process.env.JWT_SECRET, { issuer: 'your-app', audience: 'your-frontend' });
    req.user = payload;
    next();
  } catch {
    res.status(401).json({ error: 'Unauthorized' });
  }
}
app.get('/me', requireAuth, (req, res) => res.json({ id: req.user.sub, role: req.user.role }));

37. How does session-based authentication work in Express?

After login, you store user data server-side (e.g., { id, role }) and send only a session ID cookie to the client. Subsequent requests use the cookie; the server retrieves the session from a persistent store (Redis/Mongo). This avoids sending credentials on each request and simplifies revocation, but requires sticky sessions or a shared store.

// npm i express-session connect-redis ioredis
const session = require('express-session');
const RedisStore = require('connect-redis').default;
const Redis = require('ioredis');
const redis = new Redis(process.env.REDIS_URL);
app.use(session({
  store: new RedisStore({ client: redis }),
  secret: process.env.SESSION_SECRET,
  resave: false, saveUninitialized: false,
  cookie: { httpOnly: true, secure: process.env.NODE_ENV==='production', sameSite: 'lax', maxAge: 60*60*1000 }
}));
app.post('/auth/login', async (req, res) => {
  const user = await authRepo.verify(req.body.email, req.body.password);
  if (!user) return res.status(401).end();
  req.session.user = { id: user.id, role: user.role };
  res.send('ok');
});

38. How do you integrate OAuth2 in Express apps?

Use the Authorization Code flow (with PKCE for public clients). Redirect users to the provider (Google/GitHub), receive the authorization code, exchange it for tokens, fetch the user profile, then create a local session or issue your JWT. The passport ecosystem reduces boilerplate.

Example sketch with passport-google-oauth20:

// npm i passport passport-google-oauth20 express-session
const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;
passport.use(new GoogleStrategy({
  clientID: process.env.GOOGLE_ID,
  clientSecret: process.env.GOOGLE_SECRET,
  callbackURL: '/auth/google/callback'
}, async (accessToken, refreshToken, profile, done) => {
  const user = await users.upsertFromGoogle(profile);
  done(null, user);
}));
app.use(session({ /* as above */ }));
app.use(passport.initialize());
app.use(passport.session());
passport.serializeUser((u, done) => done(null, u.id));
passport.deserializeUser((id, done) => users.findById(id).then(u => done(null, u)));
app.get('/auth/google', passport.authenticate('google', { scope: ['profile','email'] }));
app.get('/auth/google/callback', passport.authenticate('google', { failureRedirect: '/login' }),
  (req, res) => res.redirect('/dashboard'));

39. How do you manage role-based access control in Express?

Attach the user’s roles/permissions to req.user (from the session or JWT) and check them with small, reusable middlewares. Keep policy in one place; prefer permission strings over hard-coded role checks for flexibility.

function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) return res.status(401).end();
    if (!roles.includes(req.user.role)) return res.status(403).json({ error: 'Forbidden' });
    next();
  };
}
app.get('/admin/reports', requireAuth, requireRole('admin'), reportsHandler);

For finer control, use permission sets and check req.user.permissions instead of broad roles.

40. How do you refresh JWT tokens securely in Express?

Use short-lived access tokens and long-lived rotating refresh tokens stored in an HttpOnly secure cookie. On each refresh, issue a new access token and a brand-new refresh token, store the new refresh token’s hash server-side, and revoke the old one to prevent replay. Detect reuse: if an old token appears after rotation, revoke the entire session.

// login -> issue access + refresh (httpOnly cookie)
app.post('/auth/login', async (req, res) => {
  const user = await authRepo.verify(req.body.email, req.body.password);
  if (!user) return res.status(401).end();
  const access = jwt.sign({ sub: user.id, role: user.role }, process.env.JWT_SECRET, { expiresIn: '15m' });
  const refresh = crypto.randomUUID(); // store hash server-side
  await tokenStore.save({ userId: user.id, jti: hash(refresh), expiresAt: addDays(30) });
  res.cookie('rt', refresh, { httpOnly: true, secure: isProd, sameSite: 'strict', path: '/auth/refresh', maxAge: 30*24*60*60*1000 });
  res.json({ accessToken: access });
});
// refresh endpoint -> rotate
app.post('/auth/refresh', async (req, res) => {
  const refresh = req.cookies.rt;
  const record = await tokenStore.findByHash(hash(refresh));
  if (!record) return res.status(401).end();
  // rotate: delete old, issue new
  await tokenStore.delete(record.jti);
  const access = jwt.sign({ sub: record.userId }, process.env.JWT_SECRET, { expiresIn: '15m' });
  const newRt = crypto.randomUUID();
  await tokenStore.save({ userId: record.userId, jti: hash(newRt), expiresAt: addDays(30) });
  res.cookie('rt', newRt, { httpOnly: true, secure: isProd, sameSite: 'strict', path: '/auth/refresh', maxAge: 30*24*60*60*1000 });
  res.json({ accessToken: access });
});

Key rules:

• Access tokens short (≈15 minutes).
• Refresh tokens long (≈30–90 days) but rotated on every use.
• Store only a hash of refresh tokens server-side; treat them like passwords.
• On logout, delete the stored refresh token and clear the cookie.
• If you must use cross-site cookies, set SameSite=None; Secure and add CSRF protection on refresh and logout routes.