A quick-reference set of Express.js interview questions, covering the concepts most likely to come up in a screening or technical round.
1. Does Express have a fixed default port?
No. Express doesn't require any particular port — app.listen(3000, ...) uses 3000 only
because it's a common convention. Any free port works.
2. What is middleware in Express?
A function with access to req, res, and next that can run code, modify the request or
response, or end the cycle.
3. What does next() do? It hands control to the next middleware or route handler. Without calling it, the request-response cycle stalls.
4. What is routing?
Mapping URLs and HTTP methods to specific handler functions, e.g.
app.get("/home", handler).
5. app.use() vs app.get()?
app.use() mounts middleware (any method, any matching path); app.get() handles only GET
requests for a specific path.
6. Node.js vs Express.js?
| Node.js | Express.js |
|---|---|
| A JavaScript runtime | A web framework built on Node.js |
| No built-in routing | Provides routing out of the box |
| No middleware concept | Built-in middleware support |
| More boilerplate for a server | Faster to build the same server |
7. Name a few core features of Express. Routing, middleware, HTTP utility methods, static file serving, and a large middleware ecosystem for security, logging, and validation.
8. Popular alternatives to Express? Koa.js, Hapi.js, Fastify, Sails.js.
9. What can integrate with Express? Databases (MongoDB, MySQL, PostgreSQL), template engines (EJS, Pug), auth libraries (Passport.js), loggers (Morgan, Winston), validators (Joi, express-validator), and ORMs (Sequelize, Mongoose).
10. What is a .env file for? Storing sensitive configuration — database URLs, secrets, API keys — outside of source control.
11. What is a JWT? A JSON Web Token used for authentication and secure information exchange, made up of a header, payload, and signature.
12. Write a simple validation middleware.
const requireUser = (req, res, next) => {
if (!req.user) {
return res.status(401).json({ error: "Unauthorized - user not found" });
}
next();
};
app.get("/profile", requireUser, (req, res) => {
res.json({ message: "Profile page", username: req.user.username });
});
13. What is bcrypt used for? Hashing passwords securely before storing them, making brute-force and rainbow-table attacks much harder.
14. Why separate the Express app and server? It improves testability, keeps concerns separate, and lets the same app be reused across different server configurations.
15. What is a linter like ESLint for? Catching problematic patterns automatically, keeping code style consistent, and reducing bugs before they reach production.
16. What is the test pyramid? A model suggesting more unit tests, fewer integration tests, and even fewer end-to-end tests — the broad base gives fast feedback, and fewer expensive E2E tests sit at the top.
17. res.send() vs res.json()?
| Feature | res.send() | res.json() |
|---|---|---|
| Purpose | Sends any response type | Always sends JSON |
| Data handling | Auto-converts objects to JSON, but also sends strings/buffers/etc. | Explicitly converts to JSON |
| Typical use | HTML, text, or JSON | JSON API responses |
18. What is scaffolding? Automatically generating a starting project structure, saving setup time and keeping teams consistent.
19. How do you install the Express application generator?
npm install -g express-generator
20. What is CORS?
A browser security mechanism that controls whether a web page can request resources from a
different origin. In Express, it's usually handled with the cors middleware.
21. What are built-in Express middleware functions?
express.json(), express.urlencoded(), express.static(), express.raw(),
express.text().
22. Name common third-party middleware.
body-parser, cors, morgan, helmet, express-session, passport.
23. When does application-level middleware run?
For every request, since it's bound to the app instance with app.use().
24. Explain router-level middleware.
Middleware attached to a specific express.Router() instance, running only for that
router's routes.
25. How do you secure an Express app?
Use helmet, validate and sanitize input, enforce HTTPS, apply rate limiting, and keep
dependencies up to date.
26. What is app.router()... wait, what is app.route()? Returns a chainable route instance for defining multiple HTTP methods on a single path without repeating it.
27. What arguments does a route handler receive?
req, res, and optionally next (making it act like middleware if next() is called
instead of sending a response).
28. How does Express handle errors?
Through next(err) and four-argument error-handling middleware, which centralizes error
responses instead of scattering try/catch everywhere.
29. What is dynamic routing?
Using route parameters (:id) to capture variable segments of a URL, e.g.
app.get("/users/:userId", ...).
30. How do you serve static files?
app.use(express.static("public")).