Interview Questions Flashcards
Walk us through the database schema of your itinerary app.
I have users, itineraries, and comments as main databases inside MongoDB. Itineraries also make reference to users, and comments. I found linking these tables were quite difficult at first due to my lack of knowledge and I’m still not completely sure how everything works under the hood but I hope to be able to dig deeper into this and become an expert.
How do you handle authentication in your app?
I use JSON web tokens to store them in HttpOnly cookies for security. I then verify tokens on protected routes. I prefer using cookies over localStorage as cookies reduce XSS risk as they can’t be accessed via Javascript.
How do you structure your backend folders in Express?
I separate routes, controllers, services, and models. Middleware is isolated too. It keeps logic clean and testable.
Follow-up: What would you change if it got huge?
A: I’d modularize by feature (e.g., /user, /itinerary) and maybe shift to a monorepo or microservice-style setup.
What’s the most complex feature you’ve built in this app?
Combining itineraries across users with merge conflict resolution. Each task has metadata, and edits are tracked.
Follow-up: How do you detect conflicts?
A: I compare timestamps and task IDs during merge, and notify users if fields like location/time overlap.
How do you handle form validation?
I use react-hook-form for speed and control, paired with Zod for schema validation.
Follow-up: Why not Formik?
A: Formik’s great, but react-hook-form has better performance, especially with complex dynamic forms.
How do you design responsive layouts?
I use TailwindCSS and mobile-first design. Flex and grid layouts make it easy to adapt to different screen sizes.
Follow-up: What’s your approach for cross-browser testing?
A: I use Chrome DevTools, Firefox, and BrowserStack to spot layout bugs. I also run Lighthouse audits.
How do you manage side effects in React?
I use useEffect with care, keeping dependencies tight. For async calls, I isolate them in services and handle cleanup.
Follow-up: What mistake did you learn from here?
A: Leaving stale closures in useEffect caused bugs. Now I memoize handlers and avoid nested async logic inside the hook itself.
What’s your favorite clever frontend trick in the app?
Dynamic estimated cost calculator (calculated with tags e.g. museum, dinner (with levels)) that updates based on task data and compares to user’s budget in real time. With those tags you can also filter out and search through your itinerary for a specific activity that stays all throughout the itinerary.
Follow-up: How’s that implemented under the hood?
A: I debounce the input, pull relevant data, and compute totals in a reducer function. It’s responsive without over-rendering.
How do you integrate with external APIs like Google Maps or weather data?
I use Axios in a Node middleware to call APIs securely, store results with TTL caching in MongoDB, and serve to frontend.
Follow-up: Why not call APIs directly from the frontend?
A: To avoid exposing API keys and stay within rate limits by caching and batching requests server-side.
How would you monitor and log issues in production?
I could use tools like Sentry for the front-end and Winston Logger for the back end. I have never had ot log issues on production for high-traffic deployments.
I use SPL alerts for logging issues on Splunk.
What’s the most challenging API you’ve worked with?
Google Maps — managing rate limits, billing quotas, and handling different data formats for directions and geocoding.
Follow-up: How did you optimize usage?
A: I throttle requests, cache results with coordinates, and provide fallback when usage nears the limit.
How would you add offline support to your app?
I’d use service workers via Workbox to cache static assets and some API responses. IndexedDB for local drafts.
Follow-up: What data would you cache?
A: User itineraries, profile data, and static map tiles — anything needed to view or edit without full functionality.
What’s something recent you learned that changed how you build?
TailwindCSS - Spent too much time figuring out CSS for basic things. Took time away from actual work. Spent a weekend figuring out the basics and went from there.
How do you decide when to use a library vs building something yourself?
I weigh complexity, long-term maintenance, and how common the problem is. If it’s solved well already, I don’t reinvent.
Follow-up: Give an example of a “build it” moment.
A: I built my own PDF export rather than paying for a third-party service, since Puppeteer gave me more control.
How do you balance adding features vs refactoring?
I aim for 80/20 — small, continuous refactors during feature work, bigger ones between sprints.
Follow-up: How do you know when it’s time?
A: When logic repeats or new bugs stem from complexity — I use that as a signal to simplify.
How do you stay current with new tools or trends?
Twitter dev circles, YouTube channels like Fireship and Theo, and experimenting in side projects.
Follow-up: What trend are you currently exploring?
A: Server components in React — testing how to simplify backend/frontend coupling.
What’s a project you admire technically and why?
Google. If you tried to pitch Google today, even knowing it’s possible and has been done for over 20 years, you’d still get crazy looks.
How would you build a collaborative editing system?
I’d use WebSockets or WebRTC for live updates, a shared locking model to prevent conflicts, and optimistic UI rendering.
Follow-up: What’s a challenge with optimistic updates?
A: Rollback logic. If the server rejects a change, I need to revert the UI state and notify the user — tricky timing-wise.
What’s your testing strategy like for your app?
Constant testing on client side (live in-app), and always trying to break the database on server side.
How do you handle environment-specific config?
I use dotenv for local/dev, and host-managed env vars for staging/prod. Each build pulls the right set automatically.
Follow-up: What’s tricky about that?
A: Syncing keys across environments and preventing dev secrets from leaking into git. I now automate that setup with scripts.
If an API you depend on goes down, how does your app respond?
I show fallback data or “unavailable” states with skeleton loaders. The backend caches stale responses for some time.
Follow-up: How would you simulate that in dev?
A: I use mock servers or intercept requests in the frontend with tools like MSW (Mock Service Worker).
What’s one area of your project you’d rebuild entirely today?
The comment system. Right now it’s flat and basic — I’d redesign it to support threads, live updates, and moderation.
Follow-up: What’s holding you back?
A: Just time. It works, but rebuilding would mean updating schemas, relationships, and UI. On the roadmap though.
You mentioned SPL and Splunk, which are specific to your current role. How do you feel about translating that knowledge into a more traditional web development context, particularly around full-stack development?
While SPL and Splunk are specialized tools for security data, I think the principles of data manipulation and optimization translate well into traditional web development. In my spare time, I’ve been working on a travel planning app built with the MERN stack (MongoDB, Express.js, React, and Node.js), and this project has allowed me to develop my skills in full-stack development.
For example, one feature I’m building is the ability to set a location and a number of days for a trip, then add specific tasks throughout the day. This requires handling user inputs, storing that data, and rendering it dynamically on the front end. I used React to manage state and display the itinerary, MongoDB to store the data, and Express/Node.js to build the API layer for managing user interactions with the itinerary.
A challenge I faced was handling travel time calculations. Users can set multiple destinations, and I needed to ensure that the app can calculate travel time between locations. I initially considered building an in-house solution for calculating travel time based on distance, but I ended up integrating Google Maps API for better accuracy and ease of use. This was a good exercise in how third-party services can streamline development and offer powerful features without reinventing the wheel.
Speaking of third-party services, one of the features you mentioned for your travel app was integrating a weather API. How would you go about ensuring that integration is both scalable and secure, especially in a production environment?
For integrating the weather API in my app, I would make sure to follow some best practices around scalability and security. First, on the scalability side, I would use environment variables to store API keys securely rather than hardcoding them into the codebase. This helps with flexibility and allows me to change the key or switch between different environments (development, staging, production) without having to modify the code itself.
For scalability, I’d implement caching for weather data. Since weather information doesn’t change drastically every few minutes, I could cache the data in a Redis store and refresh it periodically—let’s say every 30 minutes. This reduces the number of requests to the weather API, which helps avoid hitting rate limits and reduces latency for users.
Security-wise, I’d ensure that all API calls are made over HTTPS to encrypt the data in transit. I’d also make sure the backend validates all API responses before sending them to the front end, in case the API provides any unexpected data. Additionally, I would rate-limit requests to avoid abuse and prevent denial-of-service attacks.