What Express is
Say what Express isA minimal web framework on Node's
http module.Explain unopinionatedIt picks no folder layout, validator or database.
Asked in interviews
AskedWhat is Express.js and why is it used?Express.js
Done 0/0
To review 0
Express 4 or older, still asked about
The usual way today
New in Express 5 or recent Node.js
The model
- An Express app is one ordered list of middleware and routes. Express walks it in the order you registered them and skips what doesn't match.
- Middleware gets
req,resandnext. It sends a response or callsnext(). If it does neither, the request hangs. next(err)or a thrown error skips the normal functions and jumps to the error handler, the one with four parameters.- A 404 isn't an error. It means the list ran out and nothing sent a response.
Apps & routes
start a server and read what the client sentStart an app and add routes
Install it and create the app
npm install expressconst app = express();Add a route per HTTP method
app.post('/users', fn);Start the server
app.listen(3000); TrapA method no route handles, such as PATCH, gets 404.
Read what the client sent
Read
:id from the URL pathreq.params.idRead
?sort=name from the query stringreq.query.sortRead the parsed body
req.body.nameValidate
:id on every route that has itapp.param('id', fn);TrapAll three come from the client, so validate them. Every param is a string.
What changed in Express 5
Name a wildcard, instead of plain
/*/*splatMark a path part optional, instead of
?/users{/:id}Replace
app.del() and res.send(status) app.delete()res.sendStatus() Know what else changed
req.param() is gone, and req.query is read-only.TipA rejected promise now reaches the error handler, as long as the route returns or awaits it.
TrapString paths reject regular expressions, so :id(\d+) fails.
Asked in interviews
AskedWhat changed between Express 4 and Express 5?Middleware & its order
the chain every request walksMiddleware and next()
Move on to the next match
next()Jump to the error handler
next(err)Skip the rest of this route
next('route')Stop there when more code follows
return next();Name the five middleware typesApplication-level, router-level, error-handling, built-in, third-party.
TrapA middleware that neither responds nor calls next() hangs the request.
Order of execution
app.use(logger);every requestapp.use('/api', auth);only paths under /apiapp.get('/api/users', list);sends, so the chain stopsapp.use(notFound);only if nothing answeredapp.use(onError);only after an error
TipParsers and auth go first. The 404 and error handlers go last.
Asked in interviews
AskedWhat is Express.js middleware execution order?app.use, app.get or app.all
app.use('/api', fn);Mount middleware on a sectionapp.get('/api/users', fn);Answer GET and HEAD on one pathapp.all('/api/users', fn);Run a rule for every method on one pathyesno
TipPrefix means /api also matches /api/users. Strips means Express removes the mount path from req.url.
Split routes with Router
Create a router
const router = express.Router(); Mount it under a prefix
app.use('/users', router);Run middleware for that router only
router.use(requireAuth); TipA router is a mini-application with its own middleware and routes, but no server.
Asked in interviews
AskedWhat is Express Router and why use it?Transform requests and responses
Replace the body before the handlers
req.body = fn(req.body);Rewrite every JSON response
const orig = res.json;res.json = (d) => orig.call(res, fn(d));TrapCall the original with this set to res, or Express can't send the body.
Asked in interviews
AskedHow do you implement request/response transformation middleware?Errors & 404s
send every failure to one handlerWrite the error handler
Register it after every route
app.use((err, req, res, next) => {});Pass the error on if the response has started
if (res.headersSent) return next(err);Catch async errors in Express 4
Promise.resolve(fn(req, res, next)).catch(next); TipIn Express 4, a rejected promise goes unhandled and crashes the process by default since Node.js 15.
TrapExpress spots it by its four parameters, so keep next even when unused.
Asked in interviews
AskedHow do you implement error handling in Express.js?Handle 404s
After every route, catch the unmatched requests
app.use((req, res) => res.sendStatus(404)); Report a missing recordSend
404 from the route, or pass an error with that status.TrapA 404 isn't an error, so the error handler never sees it.
Asked in interviews
AskedHow do you handle 404 errors in Express.js?Custom error classes
Make a base error class
class AppError extends Error {}this.isOperational = true;Respond to an operational errorSend its message and status code.
Respond to a programmer error in productionHide the details behind a generic
500.TipAn operational error is an expected failure, such as a missing record. A programmer error is a bug.
Responses & pages
send data, files and rendered HTMLres.send, res.json or res.end
res.send('<p>Hi</p>'); Send text or HTMLres.json(null);Send JSON, even nullres.status(204).end(); End with no body, using Node's own methodExpress sets the headerExpress adds nothing
TipCall only one per request. The first call ends the response.
Asked in interviews
AskedWhat is the difference between res.send(), res.json() and res.end()?Render a page
Pick an engine and render a template
app.set('view engine', 'ejs');res.render('index', { title });Share a value with every page
app.locals.siteName = 'Acme';Set a value for one request
res.locals.user = req.user;TrapEvery request sees the same app.locals, so keep per-user data out.
Serve static files
Serve
public/logo.png at /logo.pngapp.use(express.static('public')); Add a virtual path prefix
app.use('/static', express.static('public')); TipUse path., because the path is relative to where you start node.
TrapExpress 5 ignores dotfiles by default, so .well-known files return 404.
Asked in interviews
AskedHow do you serve static files in Express.js?Content negotiation
Pick the format from the
Accept headerres.format({ 'text/html': fn });Get the best match yourself
req.accepts(['json', 'html'])Tipres.format() adds Vary: Accept, so caches keep the versions apart.
TrapWith no match and no default callback, Express passes a 406 error to next().
Asked in interviews
AskedHow do you implement content negotiation in Express.js?Parse & validate input
turn raw bytes into checked dataParse the request body
Parse JSON
app.use(express.json()); Parse a URL-encoded form
express.urlencoded({ extended: true })Use the older package, built in since 4.16
bodyParser.json() TipA body over limit, 100kb by default, gets 413.
TrapWithout a parser, req.body is undefined. File forms need multer.
Asked in interviews
AskedWhat is the purpose of body-parser middleware?Validate a request
Check one field
body('email').isEmail() Collect the errors, then answer
400validationResult(req) Read only the checked fields
matchedData(req) Extra fields such as isAdmin stay out.TrapChains only record errors. They never reject a request on their own.
Asked in interviews
AskedHow do you implement data validation in Express.js?Upload files with multer
Accept one file, on
req.fileupload.single('file') Accept several, on
req.filesupload.array('photos') Cap each file's size
multer({ limits: { fileSize } })Trapfile. comes from the client, so treat it as untrusted.
Asked in interviews
AskedHow do you handle file uploads in Express.js?Login, roles & sessions
who is calling, and what they may doCheck a JWT in middleware
Verify the
Bearer tokenjwt.verify(token, secret, cb)Guard one route
app.get('/me', auth, fn);TipOn success, set req.user to the decoded payload.
Trap401 means a missing or bad token. 403 means a known user without permission.
Asked in interviews
AskedHow do you implement authentication middleware?Role-based access control
Allow only some roles on a route
authorize('admin', 'manager')Deny by default on a whole section
router.use(authorize('admin')); Check access to one recordAdd an ownership check in the handler. Roles don't cover it.
TrapRead roles from your database or a verified token, never from the client.
Asked in interviews
AskedHow would you implement role-based access control in Express.js?Sessions and cookies
Add sessions
session({ secret, resave: false, saveUninitialized: false })Keep a value for the next request
req.session.userId = user.id;Stop session fixation at login
req.session.regenerate(cb) Set a cookie page scripts can't read
res.cookie('lang', 'en', { httpOnly: true });TipA cookie holds about 4KB in the browser. A session stores data on the server, with only its ID in a cookie.
TrapMemoryStore leaks memory and works in one process. Use Redis or a database.
CORS, headers & rate limits
control who may call the API, and how oftenEnable CORS
Allow every origin
app.use(cors()); Allow your own domains
cors({ origin: ['https://a.com'] })Allow cookies
cors({ origin, credentials: true })Browsers reject * with credentials.Tipcors() answers the OPTIONS preflight the browser sends first.
TrapCORS only controls what browsers may read. It isn't access control.
Asked in interviews
AskedHow do you enable CORS in Express.js?Security headers with Helmet
Set safe defaults
app.use(helmet()); Name two headers it sets
Content-Security-Policy limits where scripts load from. Strict-Transport-Security forces HTTPS.TipHelmet also removes X-Powered-By.
TrapKeep 'unsafe-inline' out of scriptSrc. Use a nonce or a hash.
Asked in interviews
AskedHow do you implement security headers in Express.js?Rate limit with express-rate-limit
Allow 100 requests per 15 minutes, then
429rateLimit({ windowMs: 900000, limit: 100 })app.use('/api', limiter);See the real IP behind a load balancer
app.set('trust proxy', 1);Tipmax is the older name of limit. Add a stricter limiter on the login route.
TrapThe default store counts per process. With several instances, use Redis.
Asked in interviews
AskedHow do you implement rate limiting in Express.js?Rate limit algorithms
With a limit of 100, bursts on each side of a boundary let 200 through.
Count per clock windowFixed window. Cheap, but allows twice the limit across a boundary.
Store a timestamp per requestSliding window log. Exact, but memory grows with traffic.
Blend the current and previous countsSliding window counter. Close to exact and cheap.
Cap bursts and set a steady averageToken bucket. Bucket size caps a burst, refill rate sets the average.
TrapRedis commands sent one at a time can race. A Lua script runs them atomically.
Asked in interviews
AskedHow do you implement API rate limiting with different strategies?Caching & databases
reuse results and keep writes consistentCache and compress responses
Let browsers and CDNs reuse data
res.set('Cache-Control', 'max-age=60');Use private for per-user data.Read Redis first, save on a miss
client.get(key)client.setEx(key, ttl, json)Save only a 200, never a 404.Invalidate when the data changes
client.del(key)Compress with gzip, deflate or Brotli
app.use(compression()); TipBody parsers inflate compressed requests. Compression costs CPU, so a busy site compresses at a reverse proxy.
TrapNever cache a per-user response under the URL alone.
Connection pools and transactions
Create one pool at startup
mysql.createPool({ connectionLimit: 10 })Run one query
pool.execute(sql, params)Start on one borrowed connection
await pool.getConnection() await conn.beginTransaction() Commit, then respond
await conn.commit()Undo on any error, and release
await conn.rollback()conn.release()TipEach process has its own pool, so 4 workers with a limit of 10 can open 40 connections.
TrapA query on the pool runs outside the transaction. Always release conn, or the pool runs out.
Run it in production
config, logs, health and a clean stopEnvironment variables
Load
.env with a packagerequire('dotenv').config(); Load
.env with no package (20.6+)node --env-file=.env app.jsMake Express cache templates
NODE_ENV=production TrapEvery value is a string, so convert numbers and booleans.
Asked in interviews
AskedHow do you handle environment variables in Express.js?Logs and request IDs
Log one line per request
app.use(morgan('combined')); Reuse or create a request ID
req.get('x-request-id') || randomUUID()Read the ID deep inside services
AsyncLocalStorage TipIn production, write structured JSON logs to stdout, with Pino.
Trapconsole.log() is synchronous on a terminal or file, which slows a busy app.
Health, metrics and profiling
Report whether this instance can serve
app.get('/health', check);200 if it can, 503 if not.Split liveness and readinessLiveness finds a stuck process. Readiness checks the dependencies.
Time a request
process.hrtime.bigint() See when sync work blocks every request
monitorEventLoopDelay() Write a CPU or heap profile to disk
node --cpu-prof app.jsnode --heap-prof app.jsTipprom-client exposes latency histograms and event loop lag. Never bind node --inspect to a public address.
TrapA liveness check on the database restarts every container in an outage.
Time out slow requests
Send
503 when a timer firessetTimeout(send503, 10000);Clear it when the response ends
res.on('close', clear);Tip503 means the server was slow. 408 means the client was slow to send.
TrapThe timeout doesn't stop the handler. Check res.headersSent, and abort fetch() calls.
Asked in interviews
AskedHow do you implement request timeout handling?Graceful shutdown
Catch the stop signal
process.on('SIGTERM', stop);Refuse new connections, finish open ones
server.close(cb); Force the exit if a WebSocket keeps it open
setTimeout(() => process.exit(1), 10000);TipFail the readiness check first, and close the pool before process.exit(0).
Asked in interviews
AskedHow do you implement graceful shutdown in Express.js?Clustering across CPU cores
Start one worker per core
cluster.fork();Tell the primary from a worker
cluster.isPrimary It replaced cluster.isMaster .Count usable cores
os.availableParallelism() TipPM2 does the same with -i max. Clustering also multiplies memory and database connections.
TrapWorkers share no memory. Keep sessions and counters in Redis.
Asked in interviews
AskedHow do you implement clustering in Express.js for better performance?Structure, tests & services
what a larger system addsStructure a large app
Split the codeBy feature, then by layer.
Give each layer one jobController reads
req. Service holds the logic. Repository talks to the database.Let tests import the appBuild it in
app.js, listen in server.js.TrapKeep req and res out of services, so jobs and tests can call them without HTTP.
Asked in interviews
AskedHow would you structure a large Express.js application?Test and document the API
Test a route through HTTP
request(app).post('/users').expect(201) Split the testsIntegration per route, unit for services, a few end-to-end.
Build an OpenAPI spec from comments
swaggerJsdoc(options) Serve Swagger UI at
/api-docsswaggerUi.setup(specs) TipComments can drift from the code. Spec-first means you write openapi.yaml by hand.
TrapUse a separate test database, never a shared one.
Version an API
Put the version in the URL
app.use('/api/v2', v2Router);Skip to the next route on another version
next('route')TipA header keeps one URL per resource, but caches keyed on the URL can't tell versions apart.
TrapPlain next() stays on the same route, so v1 would answer every version.
Asked in interviews
AskedHow do you implement custom middleware for API versioning?Add WebSockets
Share one port with HTTP
http.createServer(app) socketIo(server) server.listen(3000) Reach clients on other instancesUse a Socket.IO Redis adapter. Long-polling also needs sticky sessions.
TipSocket.IO has its own protocol, so plain WebSocket clients can't connect. For raw WebSockets, use ws.
Trapapp.listen() would create a second server that Socket.IO isn't attached to.
Asked in interviews
AskedHow do you implement WebSocket support with Express.js?Talk to other services
Pick how to call a serviceHTTP for an answer now. A message broker for work that can wait.
Wrap a call in a circuit breaker
new CircuitBreaker(fn, { timeout: 3000 })Explain open and half-openOpen returns the fallback at once. Half-open lets a trial call through.
TrapRetry only idempotent calls such as GET. A retried POST can run twice.
Asked in interviews
AskedHow do you implement microservices communication with Express.js?Express, Fastify or NestJS
Pick ExpressMinimal core, widest middleware choice, full design freedom.
Pick FastifyThroughput and built-in JSON Schema validation.
Pick NestJSOne fixed architecture for a large team, with dependency injection.
TipNestJS runs on Express by default, or on Fastify.
TrapExpress has no built-in validation or structure, so large codebases drift.
Asked in interviews
AskedWhen would you choose Express over NestJS or Fastify?Nothing matches. Try a shorter word, or clear the search.
Found this useful? Pass it on.
Pro · $10/mo
This sheet stays free. With Pro, you can:
- Every answer on this sheet. Read the full answer to all 52 questions it links, not just the 7 free ones.
- My sheet. The cards you star and the ones you miss in Quiz me, from every sheet, on one page to quiz and print.
- PDFs. Download this sheet and My sheet, laid out for A4, with every question a link to its answer.
- The rest of Pro. Every answer in the question library, and 1,000 AI credits a month.