ExpressJS Advanced Topics in ExpressJS Flashcards

24 sample cards from the Advanced Topics in ExpressJS deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is OpenID Connect (OIDC) and how does it relate to OAuth 2.0?

   OIDC is an identity/authentication layer built on top of OAuth 2.0. It adds an ID token (a JWT) that carries the user's identity claims, enabling 'sign in with' functionality that OAuth alone (authorization only) does not provide.

2. What is Cross-Site Scripting (XSS) and how is it prevented in Express apps?

   XSS injects malicious scripts into pages viewed by other users. Prevent it by escaping/encoding output (default in EJS/Handlebars), validating and sanitizing input, and setting a Content-Security-Policy header.

3. What is SQL injection and how do you prevent it?

   SQL injection sends malicious SQL through user input to manipulate queries. Prevent it with parameterized queries / prepared statements (or an ORM that parameterizes), plus input validation — never concatenate user input into SQL strings.

4. What is Cross-Site Request Forgery (CSRF) and a common defense?

   CSRF tricks an authenticated user's browser into sending unwanted requests. Defenses include anti-CSRF tokens (synchronizer tokens), SameSite cookie attributes, and verifying the Origin/Referer header.

5. What is Helmet.js and what does it do?

   Helmet.js is Express middleware that sets various security-related HTTP response headers (e.g. Content-Security-Policy, X-Content-Type-Options, Strict-Transport-Security) to protect the app from well-known web vulnerabilities.

6. Which key security headers does Helmet.js set by default?

   By default Helmet sets headers such as Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options (frameguard), Strict-Transport-Security (HSTS), X-DNS-Prefetch-Control, and it removes the X-Powered-By header.

7. What does the Content-Security-Policy (CSP) header protect against?

   CSP restricts which sources (scripts, styles, images, etc.) the browser may load and execute, mitigating XSS and data-injection attacks by disallowing untrusted or inline resources.

8. Why should you disable/remove the X-Powered-By header in Express?

   By default Express advertises 'X-Powered-By: Express', revealing the stack to attackers. Removing it (app.disable('x-powered-by') or via Helmet) reduces fingerprinting and targeted attacks.

9. What is rate limiting and why is it used to secure Express apps?

   Rate limiting caps how many requests a client can make in a time window (e.g. via express-rate-limit). It mitigates brute-force attacks, credential stuffing, and denial-of-service by throttling abusive traffic.

10. What is the purpose of input validation and sanitization middleware (e.g. express-validator)?

    It checks that incoming data matches expected types/formats (validation) and strips or escapes dangerous content (sanitization), defending against injection, XSS, and malformed-data errors before the data reaches business logic.

11. What is caching and what are the main types relevant to a web server?

    Caching stores copies of data/computations to serve future requests faster. Main types: client/browser caching, CDN/edge caching, reverse-proxy caching, in-memory application caching (e.g. Redis), and database query caching.

12. What is a cache hit ratio and how is it calculated?

    The cache hit ratio measures how often requests are served from cache. It is calculated as $$\text{hit ratio} = \frac{\text{hits}}{\text{hits} + \text{misses}}$$ A higher ratio means better cache effectiveness.

13. Why is Redis commonly used as a caching layer with Express?

    Redis is an in-memory key-value store offering very low-latency reads/writes, TTL-based expiration, and data structures. It is used to cache query results, sessions, and computed data, reducing load on primary databases.

14. What is the difference between cache TTL and cache invalidation?

    TTL (time-to-live) automatically expires a cached entry after a set duration. Invalidation actively removes or updates cached entries when the underlying data changes, ensuring stale data is not served.

15. What do the HTTP Cache-Control and ETag headers do?

    Cache-Control directives (e.g. max-age, no-cache, public/private) tell clients/proxies how and how long to cache a response. ETag is a validator/fingerprint the client sends back (If-None-Match) so the server can reply 304 Not Modified if unchanged.

16. What is load balancing and why is it needed for scaling Express apps?

    Load balancing distributes incoming requests across multiple server instances to improve throughput, availability, and fault tolerance. It prevents any single instance from becoming a bottleneck as traffic grows (horizontal scaling).

17. Name common load-balancing algorithms.

    Round-robin, weighted round-robin, least-connections, IP hash (source-based/sticky), and least-response-time. Each decides how requests are routed among backend servers.

18. What is the difference between horizontal and vertical scaling?

    Vertical scaling (scaling up) adds more resources (CPU/RAM) to a single machine. Horizontal scaling (scaling out) adds more machine/process instances behind a load balancer. Node/Express typically scales horizontally due to its single-threaded event loop.

19. How does the Node.js cluster module or PM2 help scale an Express app on one machine?

    They fork multiple worker processes (typically one per CPU core) that share the same server port, allowing the app to utilize all cores and balance connections across workers, since a single Node process runs on one thread.

20. What is a sticky session and when is it needed with load balancing?

    A sticky (session-affinity) load balancer routes a given client's requests consistently to the same backend instance. It is needed when session state is stored in-process; using a shared store (e.g. Redis) removes this requirement.

21. What is application profiling and what does it measure?

    Profiling analyzes a running application to measure resource usage — CPU time, memory allocation, function call frequency, and latency — to identify performance bottlenecks and inefficient code paths.

22. What is the difference between monitoring and profiling?

    Monitoring continuously observes an app's health and metrics (uptime, error rates, latency, throughput) in production over time. Profiling is a deeper, usually short-term analysis of resource consumption to find specific bottlenecks.

23. What are the 'Four Golden Signals' of monitoring?

    Latency (time to serve requests), Traffic (demand/throughput), Errors (rate of failed requests), and Saturation (how full a resource is). Popularized by Google's SRE practice for monitoring services.

24. Which tools are commonly used for monitoring Node.js/Express applications?

    Prometheus with Grafana (metrics/dashboards), the New Relic and Datadog APM agents, PM2 monitoring, and OpenTelemetry for distributed tracing. Node's built-in --prof flag and clinic.js help with profiling.

What this deck covers

Advanced Topics in ExpressJS flashcards FAQ