Full Stack interview questions – upto 8yrs

1. How do you implement user authentication in a RESTful API?

User authentication in a REST API is often implemented using JWT (JSON Web Tokens). A user logs in with credentials, and the server responds with a token. This token is included in the headers of subsequent requests to authenticate the user.

Example with JWT in Node.js:

2. How do you initialize a new Node.js project using NPM?

Initialize a new Node.js project by running the command:

npm init

This command creates a package.json file, which stores metadata about the project (like name, version, description, dependencies, etc.). You can also use the -y flag (npm init -y) to skip the prompts and create a default package.json with the default configurations.

3. What is the difference between a devDependency and a dependency in NPM?

Dependencies are libraries that are essential for the application to run. They are installed when you run npm install and are included in the dependencies section of the package.json file.

DevDependencies are libraries that are only needed during development (e.g., testing libraries, build tools) and are listed in the devDependencies section. They can be installed using:

npm install –save-dev

These packages are not required in production.

4. What are the differences between npm install, npm ci, and npm update?

npm install: Installs dependencies listed in package.json. If a package-lock.json file is present, it tries to install exact versions from it.

npm ci: Stands for Continuous Integration. It is used to install exact versions from package-lock.json without updating it. It’s faster and more deterministic than npm install, making it ideal for CI/CD pipelines.

npm update: Updates the packages listed in the dependencies or devDependencies section of package.json to the latest version that satisfies the semantic versioning rules specified in the file.

5. What is the role of @RestController in Spring MVC?

@RestController is a convenience annotation in Spring MVC that combines @Controller and @ResponseBody. It indicates that the class is a web controller and that the return value of its methods will be directly written to the HTTP response body, typically in JSON or XML format, without the need for view resolution.

6. What is a package-lock.json file and why is it important?

The package-lock.json file is automatically generated when you run npm install. It locks the exact versions of the installed dependencies to ensure consistency across different environments. This file helps in reproducing the same node module tree, avoiding version conflicts, and ensuring that all collaborators or CI/CD environments use the same versions of packages. It also improves performance by speeding up subsequent installs.

7. What are the SOLID principles in object-oriented design?

Single Responsibility Principle (SRP): A class should have only one reason to change, meaning it should only have one job.
Open/Closed Principle (OCP): Software entities should be open for extension but closed for modification.
Liskov Substitution Principle (LSP): Derived classes should be substitutable for their base classes.
Interface Segregation Principle (ISP): Clients should not be forced to depend on methods they do not use.
Dependency Inversion Principle (DIP): High-level modules should not depend on low-level modules. Both should depend on abstractions.

8. How do you improve page load performance in a React application?

Code Splitting: Use dynamic import() to split code into smaller bundles that load only when needed.
Lazy Loading: Lazy load components to prevent unnecessary loading.
Memoization: Use React.memo() and useMemo() to prevent unnecessary re-renders.
Use the Production Build: React provides an optimized production build using tools like Webpack.
Optimize Assets: Compress images, minify CSS/JS files, and utilize efficient loading of assets (lazy loading for images).

9. How event delegation in JavaScript improves performance.

Event delegation allows you to attach a single event listener to a parent element instead of attaching multiple listeners to individual child elements. This is efficient because events bubble up from the target element (child) to its parent, meaning the parent can listen to events triggered by its children. It reduces memory usage and improves performance by avoiding multiple event listener attachments.

10. How does Java’s Stream API work? Provide an example.

The Java Stream API is used to process collections of objects in a functional style. It allows operations such as filter, map, and reduce to be performed on data in a sequential or parallel manner.

List<String> names = Arrays.asList(“John”, “Jane”, “Doe”, “Emily”); List<String> filteredNames = names.stream() .filter(name -> name.startsWith(“J”)) .collect(Collectors.toList()); System.out.println(filteredNames);

11. How does Spring Security work?

Spring Security is a powerful framework that provides authentication, authorization, and protection against common security threats like CSRF and session fixation attacks. It integrates seamlessly with Spring MVC and can manage both user-based security (e.g., user roles) and method-level security via annotations like @PreAuthorize or @Secured.

12. How do you handle CORS?

CORS (Cross-Origin Resource Sharing) is a security mechanism that restricts web pages from making requests to a domain different from the one that served the web page. To handle CORS, the server must include specific headers in its response, such as Access-Control-Allow-Origin.

Example in Node.js (Express):

app.use((req, res, next) => { res.header(“Access-Control-Allow-Origin”, “*”); res.header(“Access-Control-Allow-Headers”, “Origin, X-Requested-With, Content-Type, Accept”); next(); });

13. Given a string containing just the characters (, ), {, }, [ and ], determine if the input string is valid.

import java.util.Stack; public class Solution { public boolean isValid(String s) { Stack<Character> stack = new Stack<>(); for (char c : s.toCharArray()) { if (c == ‘(‘) stack.push(‘)’); else if (c == ‘{‘) stack.push(‘}’); else if (c == ‘[‘) stack.push(‘]’); else if (stack.isEmpty() || stack.pop() != c) return false; } return stack.isEmpty(); } }

14. Write the backend code for a REST API endpoint to fetch a list of users with pagination in a Node.js Express app.

app.get(‘/users’, async (req, res) => { const page = parseInt(req.query.page) || 1; const limit = parseInt(req.query.limit) || 10; const skip = (page – 1) * limit; try { const users = await User.find().skip(skip).limit(limit); const total = await User.countDocuments(); res.json({ total, page, totalPages: Math.ceil(total / limit), users }); } catch (err) { res.status(500).json({ message: ‘Server error’ }); } });

15. Given an array of integers nums and an integer target, return indices of the two numbers such that they add up to target.

import java.util.HashMap; public class Solution { public int[] twoSum(int[] nums, int target) { HashMap<Integer, Integer> map = new HashMap<>(); for (int i = 0; i < nums.length; i++) { int complement = target - nums[i]; if (map.containsKey(complement)) { return new int[] { map.get(complement), i }; } map.put(nums[i], i); } throw new IllegalArgumentException("No two sum solution"); } }

16. How would you optimize a database query that is running slowly?

Indexing:

Add indexes to columns that are frequently queried, especially in WHERE, JOIN, or ORDER BY clauses. Be careful not to over-index, as this can slow down write operations.

CREATE INDEX idx_user_email ON users(email);

*Avoid SELECT :

Only query the specific columns you need to avoid fetching unnecessary data.
SELECT name, email FROM users WHERE status = ‘active’;

17. Explain how you would handle authentication in a full-stack application.

Authentication: Verifying the user’s identity. Typically, this is done using JWT (JSON Web Tokens) or OAuth.

JWT Authentication: After login, a token is issued and included in the headers of each subsequent request for authentication.

const token = jwt.sign({ userId: user.id }, ‘secret’, { expiresIn: ‘1h’ });

18. Explain the difference between SQL and NoSQL databases. When would you use each?

SQL (Relational Databases):

Structure: Uses structured query language and predefined schemas.
Example Databases: MySQL, PostgreSQL, Oracle.
When to Use: Best for complex queries, structured data with relationships, and transactions. Suitable for applications where ACID (Atomicity, Consistency, Isolation, Durability) properties are important (e.g., financial systems).

NoSQL (Non-relational Databases):

Structure: Flexible schemas, can store unstructured data like JSON, XML.
Example Databases: MongoDB, Cassandra, Redis.
When to Use: Best for large-scale, distributed data storage, flexible schema designs, or when horizontal scalability is crucial. Suitable for real-time web apps, big data, or where availability and partition tolerance are prioritized.

19. Given an array of strings, write a function to find the longest common prefix.

public class Solution { public String longestCommonPrefix(String[] strs) { if (strs == null || strs.length == 0) return “”; String prefix = strs[0]; for (int i = 1; i < strs.length; i++) { while (strs[i].indexOf(prefix) != 0) { prefix = prefix.substring(0, prefix.length() - 1); if (prefix.isEmpty()) return ""; } } return prefix; } }

20. Write a function to reverse a singly linked list.

class ListNode { int val; ListNode next; ListNode(int x) { val = x; } } public class Solution { public ListNode reverseList(ListNode head) { ListNode prev = null; ListNode curr = head; while (curr != null) { ListNode next = curr.next; curr.next = prev; prev = curr; curr = next; } return prev; } }

21. What is the difference between promises and async/await in JavaScript?

Promises:

Promises represent the eventual completion (or failure) of an asynchronous operation. A promise has three states: pending, resolved, and rejected.

fetch(‘url’) .then(response => response.json()) .then(data => console.log(data)) .catch(error => console.error(error));

22. How would you implement a caching mechanism for a RESTful API?

Caching can be implemented to reduce server load and decrease response times. For REST APIs, there are several caching strategies:

Client-Side Caching: Use cache headers like Cache-Control to specify caching behavior for the client:

res.set(‘Cache-Control’, ‘public, max-age=3600’); Server-Side Caching: Use in-memory caches like Redis or Memcached to store frequently accessed data: const cache = new Map(); app.get(‘/data’, async (req, res) => { if (cache.has(‘data’)) { return res.json(cache.get(‘data’)); } const data = await fetchDataFromDB(); cache.set(‘data’, data); res.json(data); });

23. State the Query Optimization Techniques

Use EXPLAIN to analyze and optimize complex queries.
Break down large queries into smaller parts.
Use JOIN instead of multiple nested subqueries.
For large datasets, consider pagination using LIMIT and OFFSET.

EXPLAIN SELECT name FROM users WHERE age > 25;

24. Explain how you would handle authentication and authorization in a full-stack application. Authorization: Determining whether the authenticated user has access to specific resources.

Example using role-based authorization:

app.get(‘/admin’, authMiddleware, (req, res) => { if (req.user.role !== ‘admin’) { return res.status(403).send(‘Forbidden’); } res.send(‘Welcome Admin’); });

25. What is async/await in JavaScript?

A cleaner syntax to handle promises. It allows you to write asynchronous code that looks synchronous.

async function fetchData() { try { let response = await fetch(‘url’); let data = await response.json(); console.log(data); } catch (error) { console.error(error); } }

26. What are the benefits of using Spring Data JPA?

Spring Data JPA simplifies data access layers by reducing the boilerplate code required for repository creation. It provides:

CRUD operations out of the box with predefined methods.
Query creation using method names, such as findByEmail(String email).
Pagination and sorting capabilities.
Integration with Hibernate and other JPA implementations.

27. Explain the use of @Bean annotation in Spring

The @Bean annotation is used to explicitly declare a Spring bean within a configuration class. It tells Spring that the method annotated with @Bean will return an object that should be registered as a bean in the Spring application context. This is typically used for external library classes or objects that cannot be automatically scanned.

28. How does Spring handle database transactions?

Spring provides transaction management using the @Transactional annotation. It can manage transactions declaratively without the need to manage them explicitly in the code. Spring abstracts the underlying transaction infrastructure, whether JDBC or JPA, and ensures atomicity and rollback capabilities for data consistency.

29. Explain the concept of Aspect-Oriented Programming (AOP) in Spring.

AOP allows for the separation of cross-cutting concerns (like logging, security, and transaction management) from the business logic. In Spring, AOP is used to modularize these concerns by providing features like method interceptors. Spring AOP uses aspects, advice, pointcuts, and join points to enable cross-cutting logic. An example would be the @Aspect annotation used to define an aspect class.

30. What is the difference between @Component, @Controller, @Service, and @Repository in Spring?

These are stereotype annotations in Spring used to declare Spring beans:

@Component: A generic annotation for any Spring-managed component.
@Controller: Marks a class as a Spring MVC controller.
@Repository: Marks a data access object (DAO), typically used in the persistence layer. It also provides automatic exception translation.

31. How would you prevent SQL injection attacks in your application?

Use Prepared Statements (Parameterized Queries):

Prepared statements automatically escape user input, preventing malicious SQL code from executing. Example in Java (JDBC):

String query = “SELECT * FROM users WHERE username = ? AND password = ?”; PreparedStatement stmt = connection.prepareStatement(query); stmt.setString(1, username); stmt.setString(2, password); ResultSet rs = stmt.executeQuery();

32. How do you handle state management in React?

Local State:

Managed using React’s built-in useState hook for simple, component-specific states.

const [count, setCount] = useState(0); Lifting State Up:

When multiple components need to share state, the state can be lifted to the nearest common ancestor component.

33. How would you implement real-time updates in a web application?

WebSockets:

WebSockets provide full-duplex communication between the client and the server, allowing for real-time updates.

Example in Node.js using the ws library:

34. How do you handle file uploads in a Node.js Express application?

Using Multer:

Multer is a middleware for handling multipart/form-data, which is primarily used for uploading files.

Installation:

npm install multer

35. When to use microservices and monolithic architecture?

Monolithic: For small to medium-sized applications where rapid development is needed without much complexity. Microservices: For large-scale applications that require scaling different components independently or need fault isolation.

36. What is the use of context API?

The Context API allows you to share state between components without passing props manually at every level. It’s useful for global states such as user authentication.

const UserContext = React.createContext(); const App = () => { const [user, setUser] = useState(null); return ( <UserContext.Provider value={user}> <Profile /> </UserContext.Provider> ); };

37. How to upload files to Amazon S3?

Uploading to Amazon S3 using aws-sdk:

38. How to validate the file before storing it?

Validate the file type and size before accepting it:

39. State the uses of Server-Sent Events and polling

Server-Sent Events allow a server to push updates to the browser via HTTP. It’s useful for sending real-time data updates like notifications or live sports scores.

Example:

app.get(‘/events’, (req, res) => { res.setHeader(‘Content-Type’, ‘text/event-stream’); res.write(`data: ${JSON.stringify(data)}\n\n`); });

Polling:

Periodically fetch updates from the server using regular HTTP requests. Although not as efficient as WebSockets, it’s simpler to implement.

Example:

setInterval(async () => { const response = await fetch(‘/api/updates’); const data = await response.json(); console.log(data); }, 5000);

40. How to manage global states for complex applications?

For more complex applications, libraries like Redux or MobX can manage global state with predictable state transitions and time-travel debugging.

Example using Redux:

41. Explain about Microservices architecture

Microservices Architecture:

A collection of small, independent services that communicate via APIs (often over HTTP or messaging queues).
Easier to scale and maintain because each service can be deployed independently, but it requires handling distributed systems complexity (communication, deployment, etc.).
Example: Splitting the e-commerce app into microservices such as user-service, payment-service, and order-service.

42. State the various strategies to prevent SQL injection attacks in your application?

ORM (Object-Relational Mapping):

Use ORM tools like Hibernate, Sequelize, or Mongoose, which abstract SQL queries and automatically protect against injection by handling the input safely.

Sanitize Inputs:

Sanitize and validate user inputs, especially if you’re concatenating user input into SQL queries.

Limit Database Permissions:

Ensure the database user your application uses has limited privileges. For example, only allow the database user to access tables and execute queries needed by the app.

Web Application Firewalls (WAF):

Use firewalls that inspect SQL queries for patterns that indicate injection attacks.

43. How would you implement pagination in a database query?

Pagination is essential for improving performance when dealing with large datasets. It allows fetching only a subset of records from the database.

SQL Example: Using LIMIT and OFFSET in SQL queries:

SELECT * FROM users ORDER BY id LIMIT 10 OFFSET 20;

LIMIT 10: Limits the result to 10 rows.
OFFSET 20: Skips the first 20 rows.

44. Explain how you would optimize the front-end performance of a web application.

There are several ways to optimize the front-end performance:

Minification and Compression:

Minify JavaScript, CSS, and HTML to reduce file sizes. Enable gzip or Brotli compression on the server.

Example:

npm install –save-dev uglify-js

Code Splitting:

Use tools like Webpack or Rollup to split your code into smaller bundles and load only the required chunks on demand.

Example using Webpack’s dynamic imports: import(‘./large-module’).then(module => { module.doSomething(); });

45. How would you prevent Cross-Site Scripting (XSS) attacks in your web application?

Input Validation and Sanitization:

Always validate and sanitize user inputs to remove any harmful scripts before storing or displaying them.

Example using DOMPurify to sanitize HTML input in JavaScript:

const cleanHTML = DOMPurify.sanitize(userInput);

Output Encoding:

When rendering user input on a web page, escape special characters like <, >, &, and ” to prevent them from being interpreted as HTML or JavaScript.

In JavaScript, use textContent instead of innerHTML when inserting dynamic content.

const userElement = document.createElement(‘p’); userElement.textContent = userInput;

46. How do you implement user authentication in a full-stack application using JWT (JSON Web Tokens)?

User Login and Token Generation: When the user logs in with valid credentials, generate a JWT token on the server and send it back to the client.

Token Storage: Store the JWT token on the client side, either in localStorage or HTTP-only cookies for security.

Token Verification: Protect routes by verifying the JWT token on each request.

Token Expiration and Refresh: JWT tokens can expire. Implement a token refresh mechanism using refresh tokens or by prompting the user to re-authenticate after expiration.

47. Explain the MVC (Model-View-Controller) architecture pattern.

MVC (Model-View-Controller) is a software design pattern used to separate concerns in web applications.

Model:

Represents the data and the business logic of the application.
Handles database operations, application logic, and validation.

View:

Represents the UI or presentation layer. It is responsible for displaying data to the user and capturing user input.
Views in web apps are often HTML templates or front-end code (React, Angular, etc.).

Controller:

Acts as an intermediary between the Model and the View.
Receives input from the user (usually from the View), processes it (using the Model), and returns the output display (the View).

How it Works:

Controller receives a request, processes it using Model, and sends the response as a View.
This separation allows each part to be developed, tested, and maintained independently.

48. Explain various strategies to prevent Cross-Site Scripting (XSS) attacks?

Content Security Policy (CSP):

Set a Content Security Policy header to prevent the execution of inline scripts and restrict the sources of external scripts.

Example:

Content-Security-Policy: default-src ‘self’; script-src ‘self’ https://trusted.com

Use HTTP-only Cookies:

Use HTTP-only cookies for sensitive data like session tokens to prevent them from being accessed via JavaScript.

Framework Built-in Protection:

Use frameworks that have built-in protection against XSS. For example, React automatically escapes output rendered within JSX.

49. Explain token generation and verification in implementing user authentication in a full-stack application?

User Login and Token Generation: const jwt = require(‘jsonwebtoken’);

app.post(‘/login’, (req, res) => { const { username, password } = req.body; const user = getUserFromDatabase(username, password); // Validate user if (!user) { return res.status(401).send(‘Invalid credentials’); } const token = jwt.sign({ id: user.id }, ‘your_jwt_secret’, { expiresIn: ‘1h’ }); res.json({ token }); });

Token Verification:

app.get(‘/protected’, (req, res) => { const token = req.headers[‘authorization’]; if (!token) return res.status(403).send(‘Token required’); jwt.verify(token, ‘your_jwt_secret’, (err, decoded) => { if (err) return res.status(403).send(‘Invalid token’); req.user = decoded; res.send(‘Protected data’); }); });

50. Write the implementation of MVC (Model-View-Controller) architecture pattern.

Model:

class UserModel { static findAll() { return database.query(‘SELECT * FROM users’); } } View: <h1><%= user.name %></h1> Controller: app.get(‘/users’, async (req, res) => { const users = await UserModel.findAll(); res.render(‘users’, { users }); });

Request more information

Full Stack interview questions – upto 8yrs