Skip to content
Full Stack with Node.js
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Full Stack with Node.js Interview Questions in Bangalore

36 practice questions with answers for Full Stack with Node.js interviews in Bangalore.

Full Stack with Node.js jobs in Bangalore

Bangalore (Bengaluru) is India's largest technology hub, with global product companies, engineering centres, unicorn start-ups and big IT-services campuses. Product-company interviews here are usually deeper, with more scenario, design and hands-on rounds.

Below are 36 questions that match the mix of service, product and domain employers hiring node.js developers in Bangalore.

Solved for BangaloreStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

How do you implement rate limiting on a login endpoint?

Authentication and SecurityMedium
Save to ▾
Show answer
const rateLimit = require('express-rate-limit'); const { RedisStore } = require('rate-limit-redis'); const loginLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 5, standardHeaders: 'draft-7', legacyHeaders: false, keyGenerator: (req) => `${req.ip}:${req.body.email}`, store: new RedisStore({ sendCommand: (...a) => redis.sendCommand(a) }) }); app.post('/auth/login', loginLimiter, login); // Add account lockout or CAPTCHA after repeated failures.
02

Write a parameterised query with node-postgres to fetch a user's recent orders.

Databases: MongoDB, SQL and RedisEasy
Save to ▾
Show answer
const { Pool } = require('pg'); const pool = new Pool({ connectionString: process.env.DATABASE_URL, max: 10 }); async function recentOrders(userId, limit = 10) { const { rows } = await pool.query( `SELECT id, amount, status, created_at FROM orders WHERE user_id = $1 ORDER BY created_at DESC LIMIT $2`, [userId, limit] ); return rows; }
03

How do you design Express middleware that checks user roles for a route?

Express.js FrameworkMedium
Save to ▾
Show answer
Create a factory: const authorize = (...roles) => (req, res, next) => roles.includes(req.user?.role) ? next() : res.status(403).json({ error: 'Forbidden' }). Use it after authentication, for example router.delete('/:id', authenticate, authorize('admin'), handler). Keep roles and permissions in config or the database, and for complex rules move to permission-based checks or a policy library.
04

How does error-handling middleware work in Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Error-handling middleware has four parameters (err, req, res, next) and must be registered after all routes. When any middleware calls next(err) or throws in a synchronous handler, Express skips normal middleware and jumps to the error handler. In Express 4, async errors must be passed to next manually or with a wrapper; Express 5 forwards rejected promises automatically.
05

How do you implement role-based access control (RBAC) in an API?

Authentication and SecurityMedium
Save to ▾
Show answer
Define roles such as admin, manager and customer, and map them to permissions like order:read or order:refund. Put the role or permissions in the token or load them per request, and check them in middleware before handlers. For ownership rules, also check resource data, for example a customer can view only orders where order.userId equals req.user.id. Test both allowed and denied paths.
06

What is the OWASP Top 10 and which items matter most for Node.js APIs?

Authentication and SecurityMedium
Save to ▾
Show answer
The OWASP Top 10 lists the most critical web application security risks. For Node APIs the most relevant are broken access control, injection, cryptographic failures, security misconfiguration, vulnerable and outdated components, authentication failures and server-side request forgery. OWASP also publishes an API Security Top 10, which highlights broken object level authorisation, where users access others' data by changing an ID.
07

Tell me about an API you designed that you are proud of.

REST API DesignMedium
Save to ▾
Show answer
Situation: our support team used spreadsheets to track refunds. Task: I designed a refund API used by the admin panel and payment service. Action: I wrote the OpenAPI spec first, reviewed it with frontend and finance, added idempotency keys, clear error codes and pagination, and wrote contract tests. Result: integration took two days instead of a week, and refund errors dropped sharply.
08

What is package-lock.json and why should it be committed?

Node.js Core and Event LoopEasy
Save to ▾
Show answer
package-lock.json records the exact resolved version and integrity hash of every installed package, including nested ones. Committing it makes installs reproducible across developer machines and CI, so a minor update in a transitive dependency cannot silently break production. In CI use npm ci, which installs strictly from the lock file and fails if it is out of sync with package.json.
09

What is database normalisation and when would you denormalise?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Normalisation organises tables to remove duplicate data and update anomalies, typically up to third normal form, for example keeping customers and orders in separate tables linked by foreign keys. You denormalise for read performance, such as storing a product name on an order line or a precomputed order count on a user, when joins become expensive. Denormalised data must be kept in sync.
10

Tell me about a time you learned a new backend technology quickly to deliver a feature.

Node.js Core and Event LoopEasy
Save to ▾
Show answer
Situation: our team needed real-time order tracking and nobody had used WebSockets. Task: I owned the feature with a two-week deadline. Action: I spent two evenings on the Socket.IO docs, built a small prototype, shared a short demo with the team and then added rooms and Redis adapter for scaling. Result: we shipped on time, and I wrote an internal guide others reused.
11

Tell me about a time you had to debug a tricky asynchronous bug.

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Situation: customers occasionally received two invoices. Task: I had to find why it happened only in production. Action: I added request IDs to logs and found a forEach with async callbacks plus a retry triggering a second save before the first finished. I replaced it with for...of, added a unique index on invoice number and made the job idempotent. Result: duplicates stopped completely.
12

Should you use serverless functions like AWS Lambda for a Node.js API?

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
Serverless suits spiky or low-traffic workloads, event processing and quick prototypes, since you pay per invocation and need no server management. Downsides are cold starts, execution time limits, connection handling with relational databases and harder local debugging. For steady high traffic or long-lived WebSocket connections, containers are usually cheaper and simpler. Many teams mix both.
13

Explain the Node.js event loop and its main phases.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
The event loop lets Node.js run asynchronous callbacks on a single thread. Each iteration passes through phases: timers (setTimeout, setInterval), pending callbacks, poll (waits for and runs I/O callbacks), check (setImmediate), and close callbacks. Between phases Node drains the process.nextTick queue and the promise microtask queue. Understanding phases explains why setImmediate runs before a 0 ms timer inside an I/O callback.
14

Is Node.js single-threaded? Explain the role of libuv.

Node.js Core and Event LoopMedium
Save to ▾
Show answer
Your JavaScript runs on a single main thread, but Node.js itself is not purely single-threaded. libuv, the C library under Node, provides the event loop and a thread pool (default 4 threads, set with UV_THREADPOOL_SIZE) used for file system work, DNS lookups, crypto and zlib. Network I/O uses OS async mechanisms like epoll or IOCP instead of threads.
15

Tell me about a production incident you handled and what you did after it.

Testing and DebuggingMedium
Save to ▾
Show answer
Situation: our payment callback endpoint started failing after a deploy on a Friday evening. Task: I was on call. Action: I checked error logs, saw a missing environment variable, rolled back within ten minutes, then added startup config validation and a post-deploy smoke test. Result: impact was limited to a few failed callbacks we replayed, and I wrote a blameless postmortem the team used to improve deploy checks.
16

Write a Dockerfile for a production Node.js API.

Deployment, Scaling and PerformanceMedium
Save to ▾
Show answer
FROM node:22-alpine AS deps WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev FROM node:22-alpine ENV NODE_ENV=production WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . USER node EXPOSE 3000 HEALTHCHECK CMD wget -qO- http://localhost:3000/health || exit 1 CMD ["node", "src/server.js"]
17

What is NoSQL injection in MongoDB and how do you prevent it?

Authentication and SecurityMedium
Save to ▾
Show answer
If you pass req.body directly into a query, an attacker can send { "password": { "$ne": null } } and bypass checks. Prevent it by validating and casting input types with zod or Joi, rejecting objects where strings are expected, enabling Mongoose strictQuery and sanitizeFilter, and never building queries from raw user objects. Avoid $where and server-side JavaScript evaluation.
18

A regex in your validation code makes the server hang on certain inputs. What is the issue?

Testing and DebuggingHard
Save to ▾
Show answer
This is likely ReDoS, regular expression denial of service. Patterns with nested quantifiers such as (a+)+ can backtrack exponentially on crafted input, blocking the event loop. Fix by simplifying the regex, limiting input length before matching, using well-tested validators like validator.js, or a linear-time engine such as re2. Add tests with long malicious strings.
19

A mobile app team complains your API returns too much data and is slow on 4G. What would you change?

REST API DesignMedium
Save to ▾
Show answer
Add field selection like ?fields=id,name,price, smaller list representations with details on a separate endpoint, pagination with sensible limits and gzip or Brotli compression. Support ETag and Cache-Control so unchanged data returns 304. If many screens need combined data, consider a Backend-for-Frontend layer or GraphQL tailored to the mobile app.
20

What are microtasks and macrotasks?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
Macrotasks are scheduled work like setTimeout, setInterval, setImmediate and I/O callbacks, handled phase by phase by the event loop. Microtasks are promise reactions and queueMicrotask callbacks; they run right after the current synchronous code finishes and before the next macrotask. In Node, process.nextTick callbacks run even before promise microtasks. A long microtask chain can delay timers and I/O.
21

A scheduled job processes orders with setInterval every minute, but sometimes runs overlap and duplicate emails are sent. How do you fix it?

Asynchronous JavaScriptMedium
Save to ▾
Show answer
setInterval fires regardless of whether the previous async run finished. Use a recursive setTimeout that schedules the next run only after the current one completes, or keep an isRunning flag. If several instances run, use a distributed lock in Redis or a job queue like BullMQ with unique job IDs. Also make email sending idempotent by recording sent message IDs.
22

After adding a new middleware, all routes return 404 or hang. How do you debug it?

Express.js FrameworkMedium
Save to ▾
Show answer
A hang usually means the middleware never calls next() or sends a response on some path. A 404 often means it was mounted with a wrong path or registered after routes. I check order of app.use calls, add logging at the start and end of the middleware, verify every branch calls next or responds, and check async code passes errors to next.
23

What is the built-in node:test runner and when would you use it over Jest?

Testing and DebuggingMedium
Save to ▾
Show answer
Node.js ships a stable test runner in the node:test module with describe, it, mocks, coverage and watch mode, run with node --test. It needs no extra dependency and works natively with ES modules, which Jest still handles with extra configuration. Jest or Vitest offer richer snapshot testing, mocking and ecosystem. For small libraries or ESM-first services, node:test is a lightweight choice.
24

What is the difference between res.send, res.json and res.end?

Express.js FrameworkEasy
Save to ▾
Show answer
res.send sends a response and sets Content-Type based on the argument: string as HTML, Buffer as binary, object as JSON. res.json always serialises to JSON and sets application/json, and respects app settings like json spaces. res.end ends the response with no extra processing, useful for empty responses such as 204. Call only one per request to avoid headers-already-sent errors.
25

What is idempotency and how do you implement idempotency keys for a payment API?

REST API DesignHard
Save to ▾
Show answer
An idempotent operation gives the same result when repeated. For POST /payments, the client sends a unique Idempotency-Key header. The server stores the key with the request hash and response, for example in Redis or a table with a unique index. If the same key arrives again, it returns the saved response instead of charging twice. Keys expire after about 24 hours.
26

Users report seeing stale prices after an update because of caching. How do you solve it?

Databases: MongoDB, SQL and RedisMedium
Save to ▾
Show answer
Invalidate or update the cache key in the same code path that updates the price, preferably after the database commit. Use reasonable TTLs as a safety net, and version keys if needed. If several services update prices, publish a price-changed event and have consumers delete the cache. For CDN-cached responses, purge the relevant URLs or use short max-age with stale-while-revalidate.
27

What is the difference between authentication and authorisation?

Authentication and SecurityEasy
Save to ▾
Show answer
Authentication verifies who the user is, for example by checking a password, OTP or OAuth login. Authorisation decides what that verified user is allowed to do, such as whether they can delete an order or view admin reports. In an API, authentication failures return 401 and authorisation failures return 403. Both must be enforced on the server, never only in the frontend.
28

When would you choose NestJS or Fastify over Express?

Express.js FrameworkMedium
Save to ▾
Show answer
Choose Fastify when raw performance and built-in schema validation matter; it is faster than Express thanks to optimised routing and serialisation. Choose NestJS for large teams that want structure: modules, dependency injection, decorators and first-class TypeScript, similar to Spring or Angular. Express still suits small to medium services and teams that prefer flexibility and a huge middleware ecosystem.
29

npm audit reports a critical vulnerability in a dependency of a dependency. What do you do?

Authentication and SecurityMedium
Save to ▾
Show answer
First check whether the vulnerable code path is actually reachable in our usage and read the advisory. Try npm audit fix or updating the parent package to a version that pulls a patched sub-dependency. If none exists, use the overrides field in package.json to force a safe version and run tests. Track it in a ticket and enable Dependabot or Renovate for ongoing updates.
30

How do you design good REST endpoint URLs?

REST API DesignEasy
Save to ▾
Show answer
Use plural nouns for resources and let methods express the action: GET /users, POST /users, GET /users/42, PATCH /users/42. Nest only for clear ownership, like GET /users/42/orders, and avoid deep nesting. Use lowercase kebab-case, query parameters for filtering, sorting and pagination, and version the API, for example /api/v1. Avoid verbs like /getUsers.
31

Compare session-based authentication with JWT-based authentication.

Authentication and SecurityMedium
Save to ▾
Show answer
Sessions store state on the server, often in Redis, and the client holds only a session ID cookie; logout and revocation are easy. JWTs are stateless, so any service can verify them without a lookup, which suits microservices and mobile apps, but revoking a token before expiry needs a denylist or short lifetimes. Many systems combine short-lived JWT access tokens with server-stored refresh tokens.
32

Write JWT authentication middleware for Express.

Authentication and SecurityMedium
Save to ▾
Show answer
const jwt = require('jsonwebtoken'); function authenticate(req, res, next) { const header = req.get('Authorization') || ''; const token = header.startsWith('Bearer ') ? header.slice(7) : null; if (!token) return res.status(401).json({ error: 'Missing token' }); try { req.user = jwt.verify(token, process.env.JWT_SECRET, { algorithms: ['HS256'] }); next(); } catch { res.status(401).json({ error: 'Invalid or expired token' }); } }
33

You need to choose between Node.js and Java for a new high-traffic service. How would you decide?

Node.js Core and Event LoopHard
Save to ▾
Show answer
I would look at the workload and team. Node.js fits I/O-heavy services like API gateways, chat, notifications and BFF layers, with fast development and shared JavaScript skills. Java fits CPU-heavy processing, complex multi-threaded logic and teams with strong JVM experience. I would benchmark a prototype for the real access pattern and consider hiring, libraries and existing platform tooling before deciding.
34

Implement cursor-based pagination for a products endpoint.

REST API DesignMedium
Save to ▾
Show answer
router.get('/products', async (req, res) => { const limit = Math.min(Number(req.query.limit) || 20, 100); const cursor = req.query.cursor; const filter = cursor ? { _id: { $lt: cursor } } : {}; const items = await Product.find(filter) .sort({ _id: -1 }) .limit(limit + 1); const hasMore = items.length > limit; if (hasMore) items.pop(); res.json({ data: items, nextCursor: hasMore ? items[items.length - 1]._id : null }); });
35

Where should a web app store tokens: localStorage or cookies?

Authentication and SecurityMedium
Save to ▾
Show answer
localStorage is readable by any JavaScript on the page, so an XSS bug can steal tokens. HttpOnly, Secure, SameSite cookies cannot be read by JavaScript, which is safer for refresh tokens and session IDs. Cookies require CSRF protection, which SameSite=Lax or Strict plus CSRF tokens provide. A common pattern keeps the access token in memory and the refresh token in an HttpOnly cookie.
36

A client reports that a large JSON POST request fails with 413 Payload Too Large. What do you do?

Express.js FrameworkEasy
Save to ▾
Show answer
express.json() has a default body limit of 100 KB, so bigger payloads are rejected with 413. If the size is legitimate, raise it for that route only, for example express.json({ limit: '2mb' }), and check any proxy limit such as Nginx client_max_body_size. For very large data, switch to file upload to object storage or pagination instead of huge JSON bodies.

Companies with offices in Bangalore (18)

Fintech

Razorpay

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Bengaluru, Mumbai

View questions
Fintech

Paytm

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Noida, Bengaluru, Mumbai

View questions
Fintech

PhonePe

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Bengaluru, Pune

View questions
E-commerce & consumer tech

Swiggy

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru, Hyderabad

View questions
E-commerce & consumer tech

Flipkart

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Bengaluru, Hyderabad

View questions
E-commerce & consumer tech

Meesho

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
Fintech

CRED

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
E-commerce & consumer tech

Zepto

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Mumbai, Bengaluru

View questions
Fintech

Groww

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
Product

Freshworks

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Chennai, Bengaluru, Hyderabad

View questions
Product

Postman

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
Product

BrowserStack

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Mumbai, Bengaluru

View questions
E-commerce & consumer tech

Myntra

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
E-commerce & consumer tech

MakeMyTrip

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Gurugram, Bengaluru

View questions
Fintech

Juspay

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru

View questions
Consulting

Publicis Sapient

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Gurugram, Noida, Bengaluru

View questions
Consulting

Thoughtworks

Full Stack with Node.js interview questions

  • 30 questions
  • 5 rounds

Pune, Bengaluru, Chennai +2

View questions
IT services

Infosys

Full Stack with Node.js interview questions

  • 30 questions
  • 4 rounds

Bengaluru, Mysuru, Pune +2

View questions

Frequently asked questions

Which companies hire Full Stack with Node.js professionals in Bangalore?

Companies with large offices in Bangalore include Razorpay, Paytm, PhonePe, Swiggy, Flipkart, Meesho, CRED, Zepto, Groww, Freshworks. Use their company pages below to practise employer-specific sets.

Are Full Stack with Node.js interviews in Bangalore different from other cities?

The questions depend more on the company than the city. Bangalore's mix of employers decides the style: Product-company interviews here are usually deeper, with more scenario, design and hands-on rounds

How do I find Full Stack with Node.js jobs in Bangalore?

Shortlist companies with Bangalore offices, keep your CV focused on Full Stack with Node.js projects, apply on company career pages and job portals with the Bangalore filter, and practise the questions on this page before each interview.

Other cities

DelhiNoidaGurgaonHyderabadPuneChennaiMumbaiKolkataAhmedabadJaipurLucknowChandigarhIndoreKochiCoimbatoreBhubaneswarNagpurVisakhapatnamThiruvananthapuram

More ways to practise

Company-wise Full Stack with Node.js questionsExperience-wise Full Stack with Node.js questionsRole-wise Full Stack with Node.js questionsCity-wise Full Stack with Node.js questionsMost asked Full Stack with Node.js questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsFull Stack with Node.js mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsFull Stack with Node.js topic sheets