Security, Testing and Deployment Interview Questions for MEAN Stack

Show answer

The user submits credentials from an Angular form to an Express login route. The server verifies the bcrypt password hash and signs a short-lived access token containing the user id and role, often with a refresh token in an httpOnly cookie. Angular stores the access token in memory, an interceptor attaches it to requests, Express middleware verifies it, and guards control which routes the user can open.

Which security measures should every Express API in a MEAN app have?

Show answer

Use HTTPS, helmet for security headers, a strict CORS allowlist, input validation on every route, rate limiting on auth endpoints, body size limits, parameterised queries and stripped MongoDB operators, bcrypt for passwords, secrets in environment variables, and least-privilege database users. Keep dependencies updated with npm audit or Dependabot, log security events and never return stack traces in production.

How do you test Express APIs and MongoDB logic in a MEAN project?

Show answer

Write unit tests for services with Jest or Vitest, mocking external providers. For integration tests, use Supertest to send requests to the exported Express app and mongodb-memory-server or a disposable Docker MongoDB for realistic queries, seeding and cleaning data around each test. Test validation errors, auth failures and permissions, not only happy paths. Run tests in CI on every pull request.

What are the main steps to deploy a MEAN application to production?

Show answer

Build Angular with ng build to produce optimised static files and compile the TypeScript API. Host the Angular files on a CDN, static host or Nginx, and run the API on a VM, container service or Kubernetes with environment variables. Use MongoDB Atlas or a managed replica set. Configure HTTPS, domain DNS, CORS, logging and monitoring, and automate everything through a CI/CD pipeline.

Write an Express JWT verification middleware in TypeScript.

Show answer

Extend the request type with the user. import jwt from 'jsonwebtoken'; import { Request, Response, NextFunction } from 'express'; export interface AuthRequest extends Request { user?: { id: string; role: string } } export function auth(req: AuthRequest, res: Response, next: NextFunction) { const token = req.headers.authorization?.split(' ')[1]; if (!token) return res.status(401).json({ message: 'Unauthorized' }); try { req.user = jwt.verify(token, process.env.JWT_SECRET!) as AuthRequest['user']; next(); } catch { res.status(401).json({ message: 'Token invalid or expired' }); } }

How does Angular protect against cross-site scripting?

Show answer

Angular treats all values as untrusted by default and sanitises them before inserting into the DOM: interpolation escapes HTML, and binding to innerHTML, styles or URLs is sanitised to strip dangerous content. Bypass methods in DomSanitizer, like bypassSecurityTrustHtml, should be used only for trusted content. Avoid direct DOM manipulation through ElementRef with user data, and add a Content Security Policy for defence in depth.

What testing tools are used in Angular projects today?

Show answer

Angular's CLI has moved to Vitest as the default unit test runner for new projects, replacing the deprecated Karma, while many existing projects still run Karma with Jasmine or have switched to Jest. TestBed configures components and services for tests, HttpTestingController mocks HTTP calls, and component harnesses from the CDK simplify interaction tests. Playwright or Cypress handle end-to-end tests.

What is TestBed and how is it used to test an Angular component?

Show answer

TestBed is Angular's testing utility that creates a test environment similar to the application's. You call TestBed.configureTestingModule with the standalone component in imports and any mock providers, then createComponent to get a ComponentFixture. The fixture gives access to the component instance and its rendered DOM. Call fixture.detectChanges() or await fixture.whenStable() to update the view, then assert on the DOM or component state.

How do you test an Angular service that makes HTTP calls?

Show answer

Provide provideHttpClient() and provideHttpClientTesting() in TestBed, then inject the service and HttpTestingController. Call the service method and subscribe, use httpMock.expectOne('/api/products') to capture the request, assert its method and body, and flush a fake response. Finally call httpMock.verify() to ensure no unexpected requests remain. This tests the service logic without a real backend.

How do containers and orchestration fit into deploying a MEAN stack?

Show answer

Docker packages the Express API and an Nginx image serving the Angular build into portable images with all dependencies. docker compose runs them with MongoDB locally. In production, services like AWS ECS, Azure Container Apps or Kubernetes run multiple replicas, perform rolling updates, restart failed containers and scale on load. Images are built and pushed to a registry by the CI pipeline, tagged by commit.

A penetration test report says your API returns other users' invoices when the invoice id is changed. How do you fix it?

Show answer

This is broken object-level authorization, the top API risk in the OWASP list. Fix every query to scope by the authenticated user, for example Invoice.findOne({ _id: id, userId: req.user.id }), and return 404 when not found. Centralise ownership checks in services or middleware, add tests that try cross-user access, and review similar endpoints. Avoid relying on unguessable ids as protection.

An npm audit shows several high-severity vulnerabilities in the Express project. How do you handle it?

Show answer

Read each advisory to see whether the vulnerable code path is actually used in production or only in dev tooling. Run npm audit fix for safe updates, upgrade direct dependencies that pull vulnerable transitive packages, and use overrides in package.json if a fix is not yet released upstream. Test thoroughly after upgrading, enable Dependabot or Renovate for continuous updates and track any accepted risks.

After a new release, a bug affects many users. How do you respond and prevent a repeat?

Show answer

First limit the impact: roll back to the previous version or disable the feature with a flag, and communicate status to support. Then reproduce the bug, fix it with a test that covers the case, and redeploy through the normal pipeline. Afterwards, run a blameless post-mortem to find gaps, such as missing tests, review or monitoring, and add the actions to the backlog.

Write a unit test for an Angular component using TestBed.

Show answer

Test what the user sees. import { TestBed } from '@angular/core/testing'; import { CounterComponent } from './counter.component'; describe('CounterComponent', () => { it('increments when the button is clicked', async () => { const fixture = TestBed.createComponent(CounterComponent); await fixture.whenStable(); const el: HTMLElement = fixture.nativeElement; el.querySelector('button')!.click(); await fixture.whenStable(); expect(el.querySelector('p')!.textContent).toContain('Count: 1'); }); }); Standalone components need no testing module declarations.

Test an Angular service's HTTP call with HttpTestingController.

Show answer

Capture and flush the request. describe('ProductService', () => { let service: ProductService; let httpMock: HttpTestingController; beforeEach(() => { TestBed.configureTestingModule({ providers: [provideHttpClient(), provideHttpClientTesting()] }); service = TestBed.inject(ProductService); httpMock = TestBed.inject(HttpTestingController); }); it('fetches products', () => { service.getAll().subscribe((p) => expect(p.length).toBe(1)); const req = httpMock.expectOne('/api/products'); expect(req.request.method).toBe('GET'); req.flush([{ _id: '1', name: 'Pen' }]); httpMock.verify(); }); });

Write a multi-stage Dockerfile that builds Angular and serves it with Nginx.

Show answer

Build in Node, ship only static files. FROM node:22-alpine AS build WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npx ng build --configuration production FROM nginx:alpine COPY nginx.conf /etc/nginx/conf.d/default.conf COPY --from=build /app/dist/shop/browser /usr/share/nginx/html EXPOSE 80 The final image contains no Node.js or source code. nginx.conf should include try_files $uri /index.html for Angular routes.

Write an Nginx server block that serves Angular and proxies /api to Node.

Show answer

One domain, no CORS needed. server { listen 80; server_name shop.example.com; root /usr/share/nginx/html; location /api/ { proxy_pass http://api:3000; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } location / { try_files $uri $uri/ /index.html; } location ~* \.(js|css|woff2)$ { expires 1y; add_header Cache-Control "public, immutable"; } } Angular hashed file names make long caching safe.

Tell me about a time you improved test coverage or quality in a project.

Show answer

Situation: our MEAN project had almost no tests and every release broke something. Task: I volunteered to improve this. Action: I set up Supertest with an in-memory MongoDB for critical APIs, added component tests for checkout, wrote a short testing guide and made tests required in CI. I started with the five most bug-prone areas. Result: production bugs per release dropped sharply within three months.

Walk me through the MEAN project you are most proud of.

Show answer

Situation: for my final-year project I built a hospital appointment system. Task: let patients book slots and doctors manage schedules. Action: I designed MongoDB collections with indexes for slots, built a TypeScript Express API with JWT and role checks, and an Angular frontend with reactive forms, guards and signals. I added tests and deployed with Docker on a cloud VM. Result: our college clinic used it for a semester.

What is CSRF and how do Angular and Express handle it?

Show answer

Cross-site request forgery abuses cookies the browser sends automatically to make unwanted requests. Angular's HttpClient supports the double-submit cookie pattern: it reads a token from a cookie named XSRF-TOKEN and sends it in the X-XSRF-TOKEN header on mutating requests, which the server verifies. Combined with SameSite cookies and not using GET for changes, this protects cookie-based auth. Header-based JWTs are not vulnerable in the same way.

What is Angular SSR and why would you enable it?

Show answer

Angular server-side rendering renders pages to HTML on a Node.js server, so users and search engines see content immediately. The browser then hydrates the page, attaching Angular to the existing DOM; incremental hydration can hydrate parts only when needed using @defer triggers. Route-level render modes allow some pages to be prerendered at build time and others rendered per request. It improves SEO and first load for public pages.

The security team asks you to move JWTs out of localStorage in the Angular app. What design would you propose?

Show answer

Issue a short-lived access token kept only in memory in an Angular auth service, and a refresh token in an httpOnly, Secure, SameSite cookie scoped to the refresh path. On page load, call the refresh endpoint to get a new access token. An interceptor attaches the access token and refreshes on 401. Rotate refresh tokens and store their hashes server-side so they can be revoked.

Your Angular unit tests take fifteen minutes in CI and developers stop running them. What would you do?

Show answer

Measure which suites are slow. Migrate from Karma to Vitest for faster runs, avoid importing heavy shared modules in TestBed, mock HTTP and large child components, and replace real timers with fake ones. Run only affected tests on pull requests using Nx affected or similar, parallelise jobs in CI and cache dependencies. Move slow browser flows to a focused E2E suite run separately.

Your MEAN app must handle a festival sale with ten times normal traffic. How do you prepare?

Show answer

Load test the main flows with k6 or JMeter at expected peak. Serve Angular assets from a CDN, scale API instances horizontally with autoscaling, cache catalogue and home page data in Redis, and scale the MongoDB cluster tier with proper indexes. Move emails and invoices to queues, add rate limiting, set alerts on latency and errors, and freeze risky deployments during the sale.

Write a GitHub Actions job that tests and builds the Angular app.