Full Stack Developer interview questions

var, let, and const differ in scope, hoisting, and reassignment.

• var is function-scoped and hoisted, so it leaks outside blocks and causes bugs
• let is block-scoped and allows reassignment
• const is block-scoped and blocks reassignment, though object properties stay mutable
• default to const, use let only when you must reassign, avoid var in modern code

Node.js runs on a single thread and offloads I/O so it never blocks.

• libuv handles I/O via OS async APIs or a thread pool for blocking work
• completed operations queue their callbacks for the event loop
• the loop processes queues in phases: timers, pending callbacks, poll, check, close
• this lets Node serve thousands of concurrent connections without the main thread waiting

A closure is a function that keeps access to its outer scope after that function returns.

• it retains outer variables even once the enclosing function has finished
• example: a counter factory returning increment and get that share a private count
• callers cannot touch that private variable directly
• closures power partial application, memoization, and the module pattern

JavaScript objects inherit directly from other objects through the prototype chain.

• accessing a property walks up the chain until it is found or reaches null
• classical inheritance in Java uses classes as blueprints in a strict hierarchy
• ES6 class syntax is just sugar over prototypes
• it does not change the underlying runtime model

async/await is syntactic sugar over Promises for writing async code linearly.

• Promises chain with .then() and .catch(), but deep chains hurt readability
• missed error handling is easy in long chains
• async/await reads like synchronous code and uses try/catch for errors
• under the hood an async function returns a Promise and await pauses until it settles

WeakMap and WeakSet hold weak references so their entries can be garbage collected.

• the collector can reclaim referenced objects even while they appear in the collection
• ideal for attaching metadata to DOM nodes or objects without blocking cleanup
• unlike Map and Set they are not iterable
• you cannot list or enumerate their contents

JavaScript uses mark-and-sweep, freeing everything not reachable from roots.

• it periodically marks objects reachable from globals and the call stack, then frees the rest
• closures holding large objects too long cause leaks
• event listeners added repeatedly without removal leak memory
• unbounded global structures also accumulate; diagnose with heap snapshots or --inspect

The value of this depends on how a function is called, not where it is defined.

• a regular call points this at the global object, or undefined in strict mode
• a method call points this at the object before the dot
• an arrow function binds this lexically to the surrounding scope
• a common pitfall is losing this when passing a method as a callback, fixed with arrow functions or .bind()

Each HTTP version reduces head-of-line blocking and latency.

• HTTP/1.1 uses persistent connections but blocks head-of-line, so browsers open many parallel connections
• HTTP/2 adds multiplexing over one connection, header compression, and server push
• HTTP/3 replaces TCP with QUIC, removing connection-level head-of-line blocking
• QUIC lets streams fail independently, cutting latency on lossy networks

CORS is a browser rule that blocks cross-origin requests unless the server allows them.

• the server permits origins via Access-Control-Allow-Origin and related headers
• requests with custom headers or non-simple methods trigger a preflight OPTIONS first
• the browser proceeds only if the server returns correct Allow headers
• in Express use the cors middleware with an explicit allowlist, not a wildcard in production

Authentication verifies who you are; authorization verifies what you may do.

• authentication checks identity via credentials or a signed token
• authorization checks permissions, like an admin role before granting access
• confusing them creates security bugs
• example: validating a token but never checking if its user can access the requested resource

Cookies are transport; sessions and JWTs are two ways to hold user state.

• session auth stores data server-side, often in Redis, and hands the client a session ID
• the server looks up the session on every request
• JWTs encode signed claims on the client, so the server stays stateless and just verifies the signature
• a cookie can carry either; HttpOnly and Secure flags block client-side JavaScript from reading the token

Cache-Control and ETag give you time-based and content-based caching.

• Cache-Control sets policy: max-age for lifetime, no-cache to revalidate, no-store to never cache
• ETag is a fingerprint the client returns in If-None-Match next time
• the server then replies 304 Not Modified when content is unchanged
• combining them gives both time-based expiry and a content-based validation fallback

WebSockets keep a persistent two-way connection; polling repeats short requests.

• a WebSocket upgrades from HTTP to one persistent bidirectional TCP connection
• either side can push data at any time
• long polling holds a request open until data exists, then the client requests again
• WebSockets win for high-frequency two-way traffic like chat; polling is simpler for rare updates

The browser turns a URL into pixels through DOM, CSSOM, render tree, layout, and paint.

• after DNS and TCP/TLS it downloads HTML and builds the DOM, running CSS and JS as found
• CSS is parsed into the CSSOM and combined with the DOM into the render tree
• the browser calculates layout (reflow) and paints pixels to the screen
• render-blocking scripts delay first paint, so defer non-critical JS and inline critical CSS

The virtual DOM is React's in-memory copy of the real DOM used to minimize updates.

• on state change React renders a new virtual tree
• it diffs the new tree against the old one via reconciliation
• it applies only the minimal set of real DOM mutations
• this batching and diffing avoids expensive direct DOM work on every change

Controlled components drive form values from React state; uncontrolled leave them in the DOM.

• a controlled input's value flows through state and an onChange handler
• an uncontrolled input lets the DOM hold the value, read via a ref when needed
• controlled components are easier to validate, reset, and test
• uncontrolled can help huge forms where re-rendering every keystroke hurts performance

Hooks let function components use state and lifecycle features without classes.

• they add React state and lifecycle to function components
• call them only at the top level of a component or custom hook
• never call them inside conditionals, loops, or nested functions
• React relies on call order to match hook state to the right component instance across renders

useEffect runs after render, and a dependency array controls when it re-runs.

• by default it runs after every render
• omitting dependencies creates stale closures that capture outdated values
• missing cleanup on subscriptions or timers causes memory leaks
• unnecessary dependencies fire the effect too often and can cause infinite loops

useMemo caches a computed value; useCallback caches a function reference.

• useMemo returns the cached result until its dependencies change, skipping expensive recalcs
• useCallback keeps a function from being recreated on every render
• both preserve referential equality between renders
• that matters when passing values to memoized children or using them as hook dependencies