Backend Developer interview questions

REST is an architectural style for networked APIs built on HTTP.

• Stateless: each request carries all the information the server needs.
• Uniform interface: consistent resource naming and standard HTTP methods.
• Client-server separation, cacheability, and a layered system, with optional code on demand.
• In practice: expose resources as URLs like /users/42, GET to read, POST to create, no server-side session state.

PUT replaces a resource entirely, PATCH updates only part of it.

• PUT: send the full representation, the server overwrites whatever exists.
• PATCH: send only the fields that need to change.
• Example: updating an email with PUT needs the whole user object, PATCH needs just the email field.
• PATCH avoids accidentally wiping fields the client did not mean to change.

Pick status codes by their semantic meaning, not 200 for everything.

• 201 Created for a successful creation, usually with the new resource in the body.
• 404 Not Found for a missing resource.
• 400 Bad Request for a validation error, with a body describing what failed.
• 500 Internal Server Error for an unhandled server-side crash.
• Correct codes let clients handle failures programmatically without parsing messages.

The server issues a signed token after login and verifies it on each request.

• The token has three parts: a header, a base64 payload with claims like user ID and expiry, and a signature.
• The client sends it in the Authorization header on later requests.
• The server verifies the signature with its secret key, so it trusts the payload without a database lookup.
• Because JWTs are self-contained, they suit stateless APIs.

Authentication proves who you are, authorization decides what you may do.

• Authentication: checking a password or validating a token.
• Authorization: granting permissions once identity is confirmed.
• Example: verifying a JWT is authentication, checking the admin role before a delete is authorization.
• A common mistake is conflating them, so endpoints identify users but never check permissions.

A foreign key references another table's primary key to enforce referential integrity.

• Example: an orders table has a user_id pointing to the users table.
• It prevents orphaned records, like an order for a user who no longer exists.
• The database rejects inserts or updates that would break the constraint.
• This is safer than enforcing the rule only in application code.

An index is a data structure that finds matching rows without scanning the whole table.

• It is usually a B-tree built on one or more columns.
• Add an index on columns used often in WHERE, JOIN, or ORDER BY.
• Every index slows down INSERT, UPDATE, and DELETE because it must be updated too.
• So add indexes selectively, where read performance matters most.

N+1 happens when you load N records and then run one extra query per record for related data.

• Example: loading 100 posts and querying the author for each gives 101 queries.
• Fix it by loading related data in a single join or one bulk query.
• Most ORMs offer eager loading, like include in Sequelize or select_related in Django.
• That collapses the work into one or two queries.

SQL uses fixed-schema tables, NoSQL uses flexible schemas and varied data models.

• SQL: tables with a fixed schema and structured queries for joins, aggregations, and transactions.
• NoSQL: document stores like MongoDB, key-value stores like Redis, column-family stores like Cassandra.
• SQL fits relational data with strict consistency needs.
• NoSQL often trades some ACID guarantees for horizontal scalability or schema flexibility.
• At junior level, start with a relational database unless there is a clear reason not to.

Middleware is a function in the request-response pipeline that runs before or after your route handler.

• It can read or modify the request, call the next middleware, or short-circuit with a response.
• Common uses: parsing JSON bodies, verifying auth tokens, logging requests, handling CORS.
• In Express it receives (req, res, next) and must call next() to continue the chain.

A process is an independent program with its own memory, a thread shares memory within a process.

• A process has its own memory space managed by the OS.
• A thread is a smaller unit of execution sharing memory with other threads in the same process.
• Threads communicate easily via shared variables but can corrupt shared state without synchronization.
• Node.js runs on a single thread but can spawn worker threads or child processes for CPU-heavy tasks.

Async programming lets a program start an operation, keep running, and handle the result later without blocking.

• A synchronous blocking model would stall the server waiting for each database query.
• Async I/O lets a single thread serve many requests by yielding control while waiting on network or disk.
• In Node.js it is the default model; in Python you use asyncio.

HTTPS is HTTP layered over TLS, encrypting traffic and verifying the server's identity.

• The client and server perform a TLS handshake on connection.
• The server presents a certificate, the client verifies it against a trusted certificate authority.
• They negotiate a symmetric key, and all later data is encrypted with it.
• This blocks eavesdropping and impostors; backend devs configure certificates via Let's Encrypt or a cloud load balancer.

CORS is a browser security mechanism that controls cross-origin requests from JavaScript.

• It restricts JS on one origin (domain and port) from calling a different origin.
• The browser sends an Origin header, and the server replies with Access-Control-Allow-Origin to list permitted origins.
• Without it, a malicious site could make authenticated requests using a visitor's cookies.
• You configure it on the backend; non-browser clients like Postman ignore it.

Caching stores the result of an expensive operation so later requests skip the work.

• Cache-aside: the app checks the cache first, on a miss reads the database, then writes the result back to the cache.
• Write-through: every write goes to both the cache and the database at once, keeping them in sync.
• Cache-aside is the most common pattern and pairs well with Redis for query results or rendered responses.

Redis is an in-memory key-value store with rich data types, used mainly for speed.

• It supports strings, hashes, lists, sets, and sorted sets.
• Caching: store query results with a TTL to avoid expensive recomputation.
• Session storage: keep session data without hitting the main database every request.
• Rate limiting: increment a counter per user per time window.
• Memory storage makes reads and writes microsecond-fast versus a relational database.

A migration is a versioned, code-based change to the database schema stored in your repository.

• Examples: adding a column or creating a table, written as code.
• Tools like Flyway, Liquibase, or Alembic apply them in order and track which ran.
• This makes schema changes reproducible, reviewable, and tied to a commit.
• Without migrations, manual changes are hard to replicate across staging, testing, and production.

A transaction groups SQL operations into one unit that all commits or all rolls back.

• Use it when several tables must change atomically, like debiting one account and crediting another.
• Start with BEGIN, run your statements, then COMMIT on success or ROLLBACK on failure.
• Most ORMs wrap the logic in try-catch helpers that roll back on any exception.

An operation is idempotent if calling it many times gives the same result as calling it once.

• GET, PUT, and DELETE are naturally idempotent; POST is not by default.
• It matters because network failures make clients retry, which could double-charge or create duplicates.
• Make a POST idempotent with a client-generated idempotency key.
• Check whether that key was already processed before performing the operation.

The join type decides which non-matching rows you keep.

• INNER JOIN returns only rows with matches in both tables.
• LEFT JOIN returns all left rows plus matches from the right; missing matches give null columns.
• RIGHT JOIN is the mirror: all right rows regardless of a match on the left.
• LEFT JOIN is most common, like all users including those with no orders yet.