Flipkart Full Stack with Node.js Interview Questions &amp; Answers

Show answer

What is an API gateway and what does it do in a Node.js microservice setup?

Show answer

An API gateway is a single entry point in front of services. It routes requests, terminates TLS, validates tokens, applies rate limits, handles CORS, aggregates responses and collects logs and metrics. Examples are Kong, AWS API Gateway, Nginx and Envoy-based gateways. It keeps cross-cutting concerns out of each service, but must be highly available so it does not become a single point of failure.

Implement the cache-aside pattern with Redis for a product lookup.

Show answer

async function getProduct(id) { const key = `product:${id}`; const cached = await redis.get(key); if (cached) return JSON.parse(cached); const product = await Product.findById(id).lean(); if (product) { await redis.set(key, JSON.stringify(product), { EX: 300 }); } return product; } async function updateProduct(id, data) { await Product.updateOne({ _id: id }, data); await redis.del(`product:${id}`); // invalidate }

Explain the difference between Promise.all, Promise.allSettled, Promise.race and Promise.any.

Flipkart Asynchronous JavaScriptMedium

Show answer

Promise.all resolves with all results when every promise fulfils, and rejects as soon as one rejects. Promise.allSettled waits for all and returns each status and value or reason, useful when partial failure is fine. Promise.race settles with the first promise to settle, often used for timeouts. Promise.any resolves with the first fulfilled promise and rejects only if all reject.

How would you structure a large Express project?

Flipkart Express.js FrameworkMedium

Show answer

I use a layered structure: routes define endpoints, controllers handle HTTP details, services hold business logic, and repositories or models talk to the database. Add middlewares, validators, config and utils folders, and group by feature, for example modules/orders, once the app grows. This keeps controllers thin, makes services unit-testable and avoids business rules leaking into routes.

How do worker_threads differ from the cluster module?

Flipkart Node.js Core and Event LoopHard

Show answer

worker_threads run JavaScript in parallel threads inside the same process and can share memory through SharedArrayBuffer; they suit CPU-heavy tasks like image processing or hashing. cluster forks multiple Node processes that share one server port, each with its own memory and event loop, to use all CPU cores for handling HTTP traffic. In containers, many teams prefer running more replicas instead of cluster.

A dashboard endpoint makes five independent database queries one after another and takes 1.5 seconds. How would you speed it up?

Flipkart Asynchronous JavaScriptMedium

Show answer

Because the queries are independent, run them concurrently with Promise.all so total time is close to the slowest query instead of the sum. Check that the database connection pool is large enough to serve them in parallel. Then add indexes for slow queries, cache rarely changing parts in Redis, and use Promise.allSettled if the page can render with some widgets missing.

What is NoSQL injection in MongoDB and how do you prevent it?

Flipkart Authentication and SecurityMedium

Show answer

If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.

You must change a response field name used by many clients. How do you do it without breaking them?

Show answer

Treat it as a breaking change. Option one: add the new field alongside the old one, mark the old field deprecated in docs and response headers, track usage through logs and remove it after clients migrate. Option two: release it in /v2 and keep /v1 for a deprecation window. Communicate timelines clearly and add contract tests for both.

How do you limit concurrency when calling an external API for 10,000 records?

Flipkart Asynchronous JavaScriptHard

Show answer

async function runLimited(items, limit, worker) { const results = []; let i = 0; async function next() { while (i < items.length) { const idx = i++; results[idx] = await worker(items[idx]); } } await Promise.all(Array.from({ length: limit }, next)); return results; } await runLimited(records, 10, callPartnerApi); // Or use the p-limit package.

Tell me about a time you had to balance speed of delivery with technical quality.

Show answer

Situation: sales needed a partner API in one week for a client launch. Task: deliver fast without creating a mess. Action: I agreed with my manager to ship the core endpoints with validation, auth and tests, and to defer caching and admin tooling, logging them as tickets with dates. Result: the partner went live on time, and we completed the deferred work in the next sprint as planned.

How do you prioritise when multiple teams ask you for backend changes at the same time?

Show answer

I list the requests with their business impact, deadlines and effort, then discuss priority with my manager or product owner rather than deciding alone. I communicate clear timelines to each team, look for shared solutions such as one generic endpoint serving two needs, and protect time for urgent production issues. This keeps expectations realistic and avoids half-finished work.

What are the common strategies for API versioning?

Show answer

URL versioning like /api/v1/orders is the most common and easy to route and cache. Header versioning uses a custom header or Accept media type, keeping URLs clean but less visible. Query versioning like ?version=2 is simple but messy. Whatever you choose, version only for breaking changes, support old versions for a deprecation period and announce sunset dates.

Tell me about an API you designed that you are proud of.

Show answer

Situation: our support team used spreadsheets to track refunds. Task: I designed a refund API used by the admin panel and payment service. Action: I wrote the OpenAPI spec first, reviewed it with frontend and finance, added idempotency keys, clear error codes and pagination, and wrote contract tests. Result: integration took two days instead of a week, and refund errors dropped sharply.

How do you prepare a Node.js app for production readiness review?

Show answer

I check that config is validated, secrets are in a secret store, and logs are structured with request IDs. Health and readiness endpoints exist, graceful shutdown works, timeouts and retries are set on outbound calls, and rate limiting and helmet are enabled. Dashboards, alerts and runbooks are ready, load tests pass targets, backups are verified and a rollback plan is documented.

Compare offset pagination and cursor pagination.

Show answer

Offset pagination uses page and limit, translated to LIMIT and OFFSET. It is simple and allows jumping to a page, but gets slow on large tables and can skip or repeat rows when data changes. Cursor pagination uses the last seen value, such as id or created_at, to fetch the next set with a WHERE clause. It is fast and stable, ideal for feeds and infinite scroll.

How do you validate request bodies in Express?

Flipkart Express.js FrameworkMedium

Show answer

const { z } = require('zod'); const createUser = z.object({ name: z.string().min(2), email: z.string().email(), age: z.number().int().min(18).optional() }); const validate = (schema) => (req, res, next) => { const r = schema.safeParse(req.body); if (!r.success) return res.status(400).json({ errors: r.error.issues }); req.body = r.data; next(); }; router.post('/users', validate(createUser), createUserHandler);

Your service is expected to get ten times normal traffic during a festive sale. How do you prepare?

Flipkart Deployment, Scaling and PerformanceHard

Show answer

Load test at above the expected peak, then fix bottlenecks. Pre-scale instances and database capacity instead of relying only on autoscaling, warm caches, and put static and catalogue responses on a CDN. Add rate limits, queue non-critical work, set timeouts and circuit breakers, prepare feature flags to switch off heavy features, and have dashboards, alerts and an on-call plan ready.

What is the MongoDB aggregation pipeline? Give an example.

Show answer

// Top 5 cities by revenue in the last 30 days const since = new Date(Date.now() - 30 * 864e5); const result = await Order.aggregate([ { $match: { status: 'paid', createdAt: { $gte: since } } }, { $group: { _id: '$city', revenue: { $sum: '$amount' }, orders: { $sum: 1 } } }, { $sort: { revenue: -1 } }, { $limit: 5 } ]); // Each stage transforms documents; put $match early to use indexes.

Tell me about a time a database change caused an issue and what you learned.

Show answer

Situation: I added a NOT NULL column with a default to a large MySQL table during business hours. Task: the migration locked the table and checkout slowed down. Action: I rolled back, rewrote it as add nullable column, backfill in batches, then add the constraint, and ran it at low traffic after testing on a production-size copy. Result: no downtime, and we added a migration review checklist.

Write a centralised error handler with a custom AppError class.

Flipkart Express.js FrameworkMedium

Show answer

class AppError extends Error { constructor(message, status = 500) { super(message); this.status = status; } } app.use((err, req, res, next) => { const status = err.status || 500; logger.error({ err, path: req.path }); res.status(status).json({ error: status === 500 ? 'Internal server error' : err.message }); }); // In a route: throw new AppError('User not found', 404);

How do you implement and secure webhooks that your API sends to customers?

Flipkart REST API DesignHard

Show answer

Send a POST with a JSON event, a unique event ID and timestamp. Sign the body with HMAC-SHA256 using a per-customer secret and include it in a header, so receivers verify authenticity and reject old timestamps to stop replays. Retry failures with exponential backoff, log delivery attempts and make events idempotent so receivers can safely handle duplicates.

A Mongoose query returns large documents and the API is slow. What optimisations can you apply?

Show answer

Use .select() to fetch only needed fields, and .lean() to return plain objects instead of full Mongoose documents, which cuts memory and CPU. Make sure the filter and sort use an index, checked with explain. Paginate results, avoid populating deep references, and cache frequently read data. For large exports, use a cursor with for await instead of loading everything.

Implement cursor-based pagination for a products endpoint.