Full Stack Web Development Back-End Development with Node.js & Express Syllabus

How does async/await relate to Promises?

async/await is syntactic sugar over Promises: an async function returns a Promise, and await pauses execution until a Promise settles, letting async code read like synchronous code.

What does Promise.all() do versus Promise.race()?

Promise.all() waits for all promises to fulfill (rejects if any reject), returning an array of results; Promise.race() settles as soon as the first promise settles (fulfills or rejects).

What is Express.js?

A minimal, unopinionated web application framework for Node.js that simplifies building servers, routing, and middleware-based request handling.

How do you create a basic Express application instance?

const express = require('express'); const app = express(); — then app.listen(port) starts the server.

What are the main components of an Express route?

An HTTP method (get/post/put/delete), a path/pattern, and one or more handler functions with signature (req, res, next).

What is an Express Router and why use it?

express.Router() creates a modular, mountable set of route handlers (a 'mini-app') so routes can be organized into separate files and mounted with app.use().

What is middleware in Express?

A function with access to req, res, and next that runs during the request-response cycle; it can modify req/res, end the cycle, or call next() to pass control to the next middleware.

What is the difference between application-level, router-level, and error-handling middleware?

Application-level is bound to the app via app.use()/app.METHOD(); router-level is bound to a router instance; error-handling middleware has four arguments (err, req, res, next).

Why must calling next() (or sending a response) matter in middleware?

If middleware neither sends a response nor calls next(), the request hangs; next() passes control onward, and next(err) skips to error-handling middleware.

What does express.json() middleware do?

It parses incoming requests with JSON payloads and populates req.body with the parsed object.

How do you access route parameters, query strings, and the body in Express?

req.params for route params (/users/:id), req.query for query string values (?key=val), and req.body for the parsed request body.

How do you set a status code and send a JSON response in Express?

res.status(201).json({ ... }) — res.status() sets the HTTP status and res.json() serializes and sends a JSON response with the correct Content-Type.

What is the difference between res.send(), res.json(), and res.end()?

res.send() sends a response of various types (auto Content-Type); res.json() sends JSON; res.end() ends the response without sending data (or after a stream).

How do you serve static files in Express?

Use the built-in express.static middleware: app.use(express.static('public')) to serve files from the 'public' directory.

What is a template (view) engine in Express, and name two examples?

It dynamically generates HTML by injecting data into templates on the server; examples include EJS, Pug (Jade), and Handlebars.

Which middleware/library is commonly used to handle multipart/form-data file uploads in Express?

Multer — it parses multipart/form-data and stores uploaded files (to disk or memory), populating req.file or req.files.

What does REST stand for and what is it?

Representational State Transfer — an architectural style for designing networked APIs around resources accessed via standard HTTP methods and stateless requests.

What are the key constraints/principles of a RESTful API?

Statelessness, client-server separation, uniform interface, cacheability, layered system, and resource-based URIs (and optionally code-on-demand).

Which HTTP methods map to CRUD operations?

POST → Create, GET → Read, PUT/PATCH → Update, DELETE → Delete.

What is the difference between PUT and PATCH?

PUT replaces the entire resource (idempotent full update); PATCH applies a partial update to specific fields.

What does it mean for an HTTP method to be idempotent, and which CRUD methods are?

Idempotent means repeating the request produces the same result/state; GET, PUT, and DELETE are idempotent, while POST is not.

What HTTP status codes correspond to: success creation, bad request, unauthorized, forbidden, not found, and server error?

201 Created, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

Why is server-side input validation necessary even with client-side validation?

Client-side validation can be bypassed; server-side validation protects data integrity and security by ensuring all requests are checked regardless of the client.

Name a common Express validation library and what it does.

express-validator (or Joi) — defines validation/sanitization rules for request data and reports errors before the handler processes the input.

How should errors be handled centrally in an Express app?

Pass errors to next(err) so they reach a single error-handling middleware (four args: err, req, res, next) that formats and sends a consistent error response.

What is the purpose of OpenAPI/Swagger in API development?

It provides a standard, machine-readable specification to describe, document, and visualize REST APIs (e.g., Swagger UI), enabling interactive docs and client/code generation.

Name two common tools for testing Node/Express APIs.

Jest or Mocha (test frameworks) combined with Supertest (for sending HTTP requests to Express endpoints in tests); Postman is used for manual API testing.

What is the difference between authentication and authorization?

Authentication verifies who a user is (identity); authorization determines what an authenticated user is allowed to do (permissions).

What are the three parts of a JSON Web Token (JWT)?

Header (algorithm/type), Payload (claims/data), and Signature (verifies integrity), each Base64URL-encoded and separated by dots.

What is the difference between session-based and token-based (JWT) authentication?

Session-based stores session state on the server with a session ID cookie (stateful); token-based stores a signed token on the client and is verified per request (stateless).

Why should passwords be hashed with a slow algorithm like bcrypt instead of being stored in plaintext or with fast hashes?

Hashing is one-way so plaintext is never stored; bcrypt is deliberately slow and uses a per-password salt, making brute-force and rainbow-table attacks impractical.

What is a salt in password hashing and why is it used?

A random value added to each password before hashing so identical passwords produce different hashes, defeating precomputed (rainbow table) attacks.

What is Role-Based Access Control (RBAC)?

An authorization model that grants permissions based on a user's assigned role(s) rather than per individual user, simplifying access management.

What is Cross-Site Scripting (XSS) and one way to prevent it?

XSS injects malicious scripts into pages viewed by other users; prevent it by escaping/sanitizing user input and output and using a Content Security Policy.

What is the purpose of the Helmet middleware in Express?

Helmet sets various security-related HTTP headers (e.g., Content-Security-Policy, X-Frame-Options, HSTS) to protect against common web vulnerabilities.

What is CORS and why is it needed?

Cross-Origin Resource Sharing is a browser mechanism that uses HTTP headers to let a server permit requests from other origins, relaxing the same-origin policy in a controlled way.

What is SQL injection and how is it prevented in Node back-ends?

An attack that injects malicious SQL through user input; prevented using parameterized queries/prepared statements (or an ORM) rather than concatenating input into queries.