Full Stack with Node.js Last-Minute Revision

30 quick revision notes for Full Stack with Node.js

1. Node.js runs JavaScript on the V8 engine with a single-threaded event loop and non-blocking I/O handled by libuv.
2. The libuv thread pool has 4 threads by default and handles file system, DNS lookup, crypto and zlib work.
3. Event loop phases are timers, pending callbacks, poll, check and close callbacks, with microtasks drained between them.
4. process.nextTick callbacks run before promise microtasks, and both run before timers or setImmediate callbacks.
5. CPU-heavy work blocks the event loop; move it to worker_threads or a background job queue.
6. Streams process data in chunks; stream.pipeline handles backpressure and error cleanup automatically.
7. CommonJS uses require and module.exports, while ES Modules use import and export and need .mjs or type module.
8. Commit package-lock.json and use npm ci in CI for reproducible installs.
9. A caret ^1.2.3 allows minor and patch updates; a tilde ~1.2.3 allows only patch updates.
10. Promise.all fails fast on the first rejection, while Promise.allSettled waits for every promise to settle.
11. Async callbacks inside forEach are not awaited; use for...of or Promise.all with map instead.
12. Express middleware has the signature (req, res, next), and error middleware has four parameters (err, req, res, next).
13. Express 4 needs a wrapper or next(err) for async errors, while Express 5 forwards rejected promises automatically.
14. express.json() has a default body limit of 100 KB and returns 413 for larger payloads.
15. Use 201 for created resources, 204 for empty success, 401 for unauthenticated and 403 for forbidden requests.
16. GET, PUT and DELETE are idempotent; POST is not, so payment APIs use idempotency keys.
17. Cursor pagination is faster and more stable than offset pagination on large, frequently changing tables.
18. A JWT has header, payload and signature; the payload is only Base64URL encoded, not encrypted.
19. Keep access tokens short-lived and rotate long-lived refresh tokens stored in HttpOnly, Secure, SameSite cookies.
20. Hash passwords with bcrypt cost 10 to 12 or Argon2id, never with plain SHA-256 or MD5.
21. Prevent SQL injection with parameterised queries and NoSQL injection by validating and casting input types.
22. Broken object level authorisation is fixed by scoping every query to the authenticated user or tenant.
23. In MongoDB compound indexes, follow the ESR rule: equality fields first, then sort, then range fields.
24. MongoDB multi-document transactions need a replica set or sharded cluster, such as an Atlas cluster.
25. The N+1 query problem is solved with joins, eager loading, populate, batching with IN queries or DataLoader.
26. Cache-aside means read from cache first, load from the database on a miss, then set the cache with a TTL.
27. Set server.keepAliveTimeout higher than the load balancer idle timeout to avoid intermittent 502 errors.
28. Liveness probes restart a stuck container, while readiness probes only stop traffic to an instance that is not ready.
29. Graceful shutdown handles SIGTERM by stopping new connections, finishing in-flight requests and closing database pools.
30. Monitor request rate, errors, p95 and p99 latency, plus event loop lag, heap usage and garbage collection time.

Night-before checklist

• Revise your saved questions on this page once, aloud.
• Read the quick notes and mark any you cannot explain in one line.
• Rehearse a two-minute self-introduction and two project stories.
• Keep CV, ID, laptop charger and interview link ready; sleep on time.