Express.js is the most widely used Node.js web framework. These Express.js interview questions cover routing, request and response objects for freshers, then middleware, error handling, authentication, validation, security, testing and project structure for experienced backend developers.
30 questions · Updated
Fundamentals, definitions and simple scenarios. Good for freshers and warm-ups.
Express is a minimal, flexible web framework for Node.js that makes it easy to build APIs and web servers.
It provides routing, middleware, helpers for requests and responses, and template engine support, and leaves other choices, such as database and validation libraries, to you.
Its simplicity and huge ecosystem make it the most common Node.js framework.
With methods matching HTTP verbs: app.get('/users', handler), app.post, app.put, app.patch and app.delete. Route parameters are read from req.params, as in /users/:id, query strings from req.query and the JSON body from req.body after app.use(express.json()). express.Router() groups related routes into modules mounted with app.use('/api/users', router).
Middleware is a function with (req, res, next) that runs during the request-response cycle.
It can read or modify the request, end the response, or call next() to pass control on.
Middleware is used for parsing bodies, logging, authentication, CORS and rate limiting, and runs in the order it is registered.
Install express, create an app with express(), add middleware such as express.json(), define routes and call app.listen with a port, ideally read from process.env.PORT.
import express from 'express';
const app = express();
app.use(express.json());
app.get('/api/users/:id', async (req, res) => {
const user = await findUser(req.params.id);
if (!user) return res.status(404).json({ error: 'Not found' });
res.json(user);
});
app.listen(process.env.PORT || 3000);req.params holds route parameters from the URL path, such as id in /users/:id. req.query holds query string values, such as page and sort in /users?page=2&sort=name, and is used for filtering and pagination. req.body holds data sent in the request body, such as JSON from a form or API client, and needs a body-parsing middleware such as express.json().
res.json() sends JSON, res.send() sends a string, buffer or object, res.status() sets the status code and can be chained, res.redirect() redirects, res.sendFile() and res.download() send files, res.set() sets headers, res.cookie() sets cookies, and res.end() ends the response without data. Each request must get exactly one response.
express.static serves files from a folder, such as app.use(express.static("public")), so public/logo.png is available at /logo.png.
A path prefix can be added with app.use("/assets", express.static("public")), and options set cache headers.
In production, static files are often served by a CDN or Nginx instead.
app.use mounts middleware or a router for every HTTP method on a path and everything under it, so app.use("/api", router) handles /api/anything. app.get, app.post and similar handle a specific method and an exact route pattern. app.use is used for middleware such as logging and authentication; method-specific functions are used for endpoints.
next() passes control to the next matching middleware or route handler.
If a middleware neither sends a response nor calls next, the request hangs.
Calling next(err) with an error skips normal handlers and goes to the error-handling middleware. next("route") skips the remaining handlers of the current route.
express.Router() creates a mini-app with its own routes and middleware, which you mount on a path with app.use. It lets you split an API into modules, such as users, orders and products, each in its own file, and apply middleware, such as authentication, only to a group of routes.
app.use(express.json()) parses JSON bodies into req.body, and app.use(express.urlencoded({ extended: true })) parses HTML form submissions.
Both accept a limit option to reject very large bodies.
File uploads with multipart/form-data need extra middleware such as multer.
Applied problems, trade-offs and questions about your own projects.
I define an error-handling middleware with four arguments, (err, req, res, next), registered after all routes, which logs the error and sends a consistent JSON response with the right status code.
Routes pass errors with next(err).
In Express 5, rejected promises in async handlers are passed to the error handler automatically; in Express 4 I wrap async handlers or use express-async-errors.
On login I verify the password hash, then sign a short-lived access token with jsonwebtoken containing the user id and role, and often a longer refresh token stored in an HttpOnly, secure cookie.
An auth middleware reads the token from the Authorization header or cookie, verifies it and attaches the user to req.
Role-check middleware protects admin routes, and refresh tokens can be rotated and revoked.
I validate body, params and query at the edge of each route with a schema, using Zod, Joi or express-validator, in a reusable validation middleware that returns 400 with clear messages when validation fails.
Validating early means the rest of the code can trust its inputs.
I also strip unknown fields to avoid mass assignment.
I organise by feature or layer: routes define URLs, controllers handle HTTP details, services hold business logic, and repositories or models talk to the database.
Configuration, middleware and utilities live separately.
This keeps controllers thin, makes services testable without HTTP, and makes it easy to find code.
Middleware runs in the order it is registered.
Body parsers must come before routes that read req.body, CORS and security headers should come early, authentication must run before protected routes, routes come next, then a 404 handler, and the error-handling middleware must be last.
Registering things in the wrong order is a common source of bugs.
Use the cors package and configure it strictly: allow only your frontend origins, the methods and headers you need, and credentials: true only if cookies are sent, in which case the origin cannot be "*".
It must also answer preflight OPTIONS requests, which the package handles.
Allowing every origin is acceptable only for truly public APIs.
Use multer as route middleware, for example upload.single("avatar"), with memory or disk storage, or a storage engine that streams to S3.
Set limits on file size and number, filter by MIME type and check file contents, rename files, and never serve uploads from a path that can execute code.
For large files, pre-signed URLs let the browser upload directly to cloud storage.
cookie-parser reads cookies into req.cookies, and res.cookie sets them with options such as httpOnly, secure, sameSite and maxAge. express-session stores session data on the server, in Redis or a database in production, and keeps only a signed session ID in the cookie. Sessions should be regenerated after login to prevent session fixation.
Use express-rate-limit with a window and a maximum number of requests, applied globally or with stricter limits on sensitive routes such as login and password reset.
When running several servers, store counters in Redis so limits are shared.
Return 429 Too Many Requests with a Retry-After header, and set trust proxy correctly behind a load balancer so the real client IP is used.
morgan provides simple access logs, and pino-http gives fast structured JSON logs with method, URL, status code, response time and a request ID. I attach a request ID to every log line, avoid logging sensitive data such as passwords and tokens, and send logs to a central platform where they can be searched.
Read page and limit, or a cursor, from req.query, validate them and set a maximum limit.
Offset pagination (LIMIT and OFFSET) is simple but slows down on large tables and can skip items when data changes; cursor pagination using the last item's ID or timestamp is faster and stable.
Return the items plus metadata such as the next cursor or total count, and whitelist filter and sort fields.
System design, deep internals, leadership and tough follow-ups.
I use helmet for security headers, strict CORS, rate limiting with express-rate-limit, input validation, parameterised queries, and secure cookies (HttpOnly, Secure, SameSite). I limit body size, disable the X-Powered-By header, never expose stack traces in production, keep secrets in environment variables, and keep dependencies updated.
Unit tests cover services with Jest or Vitest, mocking the database.
Integration tests use Supertest to send real HTTP requests to the app without starting a server, checking status codes, bodies and headers, ideally against a test database run in Docker.
I export the app separately from the server.listen call so tests can import it.
Express is minimal and flexible but leaves structure up to you.
NestJS is an opinionated framework built on Express or Fastify, with modules, dependency injection, decorators and TypeScript, which suits large teams.
Fastify is a faster, schema-based framework with built-in validation and serialisation.
I choose based on the team size, the need for structure and performance requirements.
Express 5 automatically passes rejected promises from async handlers to the error-handling middleware, so wrappers are no longer needed.
It requires Node.js 18 or later, updates path matching (for example wildcards must be named and regular expressions in strings are no longer supported), removes deprecated methods such as res.send(status), and makes req.query read-only.
Upgrades need routes checked against the new syntax.
Create one database client or connection pool at start-up and reuse it, never a new connection per request.
Use an ORM or query builder such as Prisma, Drizzle, Sequelize or Mongoose, or a driver with parameterised queries.
Keep data access in a repository or service layer, handle connection errors and timeouts, run migrations in deployment, and close the pool on shutdown.
Set NODE_ENV=production, run behind a reverse proxy or load balancer with HTTPS, set trust proxy, use helmet, CORS, rate limiting and input validation, add structured logging and error tracking, expose health and readiness endpoints, handle graceful shutdown, run several instances (containers or PM2), and keep secrets in environment variables or a secrets manager.
Describe the API with an OpenAPI specification, either written by hand or generated from code or validation schemas, and serve interactive docs with Swagger UI or Redoc.
Version through the URL, such as /v1, or headers, keep old versions running while clients migrate, and announce deprecations.
Generated client SDKs and contract tests keep docs and code in sync.
Profile first.
Common gains come from avoiding synchronous and CPU-heavy work in request handlers, caching responses and database results in Redis, adding database indexes, compressing responses (or letting the proxy do it), setting cache headers for static content, streaming large responses, running one process per CPU core, and moving slow jobs to background queues.
For very high throughput, Fastify is faster.
See all Backend Developer interview questions, covering Node.js, Express.js, NestJS, Python, Django and more.