Full Stack Web Development Back-End Development with Node.js & Express Flashcards

24 sample cards from the Back-End Development with Node.js & Express deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. How do you serve static files in Express?

   Use the built-in express.static middleware: app.use(express.static('public')) to serve files from the 'public' directory.

2. What is a template (view) engine in Express, and name two examples?

   It dynamically generates HTML by injecting data into templates on the server; examples include EJS, Pug (Jade), and Handlebars.

3. Which middleware/library is commonly used to handle multipart/form-data file uploads in Express?

   Multer — it parses multipart/form-data and stores uploaded files (to disk or memory), populating req.file or req.files.

4. What does REST stand for and what is it?

   Representational State Transfer — an architectural style for designing networked APIs around resources accessed via standard HTTP methods and stateless requests.

5. What are the key constraints/principles of a RESTful API?

   Statelessness, client-server separation, uniform interface, cacheability, layered system, and resource-based URIs (and optionally code-on-demand).

6. Which HTTP methods map to CRUD operations?

   POST → Create, GET → Read, PUT/PATCH → Update, DELETE → Delete.

7. What is the difference between PUT and PATCH?

   PUT replaces the entire resource (idempotent full update); PATCH applies a partial update to specific fields.

8. What does it mean for an HTTP method to be idempotent, and which CRUD methods are?

   Idempotent means repeating the request produces the same result/state; GET, PUT, and DELETE are idempotent, while POST is not.

9. What HTTP status codes correspond to: success creation, bad request, unauthorized, forbidden, not found, and server error?

   201 Created, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.

10. Why is server-side input validation necessary even with client-side validation?

    Client-side validation can be bypassed; server-side validation protects data integrity and security by ensuring all requests are checked regardless of the client.

11. Name a common Express validation library and what it does.

    express-validator (or Joi) — defines validation/sanitization rules for request data and reports errors before the handler processes the input.

12. How should errors be handled centrally in an Express app?

    Pass errors to next(err) so they reach a single error-handling middleware (four args: err, req, res, next) that formats and sends a consistent error response.

13. What is the purpose of OpenAPI/Swagger in API development?

    It provides a standard, machine-readable specification to describe, document, and visualize REST APIs (e.g., Swagger UI), enabling interactive docs and client/code generation.

14. Name two common tools for testing Node/Express APIs.

    Jest or Mocha (test frameworks) combined with Supertest (for sending HTTP requests to Express endpoints in tests); Postman is used for manual API testing.

15. What is the difference between authentication and authorization?

    Authentication verifies who a user is (identity); authorization determines what an authenticated user is allowed to do (permissions).

16. What are the three parts of a JSON Web Token (JWT)?

    Header (algorithm/type), Payload (claims/data), and Signature (verifies integrity), each Base64URL-encoded and separated by dots.

17. What is the difference between session-based and token-based (JWT) authentication?

    Session-based stores session state on the server with a session ID cookie (stateful); token-based stores a signed token on the client and is verified per request (stateless).

18. Why should passwords be hashed with a slow algorithm like bcrypt instead of being stored in plaintext or with fast hashes?

    Hashing is one-way so plaintext is never stored; bcrypt is deliberately slow and uses a per-password salt, making brute-force and rainbow-table attacks impractical.

19. What is a salt in password hashing and why is it used?

    A random value added to each password before hashing so identical passwords produce different hashes, defeating precomputed (rainbow table) attacks.

20. What is Role-Based Access Control (RBAC)?

    An authorization model that grants permissions based on a user's assigned role(s) rather than per individual user, simplifying access management.

21. What is Cross-Site Scripting (XSS) and one way to prevent it?

    XSS injects malicious scripts into pages viewed by other users; prevent it by escaping/sanitizing user input and output and using a Content Security Policy.

22. What is the purpose of the Helmet middleware in Express?

    Helmet sets various security-related HTTP headers (e.g., Content-Security-Policy, X-Frame-Options, HSTS) to protect against common web vulnerabilities.

23. What is CORS and why is it needed?

    Cross-Origin Resource Sharing is a browser mechanism that uses HTTP headers to let a server permit requests from other origins, relaxing the same-origin policy in a controlled way.

24. What is SQL injection and how is it prevented in Node back-ends?

    An attack that injects malicious SQL through user input; prevented using parameterized queries/prepared statements (or an ORM) rather than concatenating input into queries.

What this deck covers

Back-End Development with Node.js & Express flashcards FAQ