Full Stack Developer Interview Questions and Answers

Questions and model answers

9 questions you are likely to hear.

1. 1

   Walk me through what happens when a user submits a form in your app until the data is saved.

   Why they ask: This tests whether you understand the full request lifecycle across layers.

   Sample answer: In my React app, the form validates input on the client with Zod for quick feedback, then sends a POST request with fetch including the auth cookie. The request passes through a load balancer to the Node.js API, where middleware checks authentication and parses the body. The controller validates again on the server, because client validation can be bypassed, then a service layer applies business rules and writes to PostgreSQL inside a transaction. The API returns 201 with the created resource, and the frontend updates its cache with TanStack Query so the list shows the new item without a full refetch.

2. 2

   How do you implement authentication securely in a web app?

   Why they ask: Auth is where many full stack apps have serious vulnerabilities.

   Sample answer: I hash passwords with bcrypt or Argon2, never store plain text, and rate-limit login attempts. For sessions in a browser app, I prefer short-lived access tokens with a refresh token stored in an httpOnly, Secure, SameSite cookie, so JavaScript cannot read it. I validate tokens on every request and check authorisation per resource, not just authentication. For social or enterprise login, I use OAuth 2.0 with PKCE through a provider. In one project I found an API that checked login but not ownership, so any user could read others' invoices; adding resource-level checks closed it.

3. 3

   When would you choose SQL over NoSQL?

   Why they ask: Interviewers check data modelling judgement.

   Sample answer: I choose a relational database like PostgreSQL when data has clear relationships, needs transactions and must stay consistent, such as orders, payments and inventory. I consider a document store like MongoDB when the schema varies a lot between records, data is read and written as whole documents and joins are rare, like product catalogues with varied attributes or event logs. Often PostgreSQL with JSONB covers both needs. In a marketplace project, we kept orders in PostgreSQL and put flexible seller product attributes in JSONB columns, which avoided running two databases.

4. 4

   How would you add caching to a slow API endpoint?

   Why they ask: This tests performance thinking and awareness of cache invalidation.

   Sample answer: First I would measure where the time goes; often an index or query fix is enough. If caching is still needed, I use Redis with a cache-aside pattern: check the cache, on a miss query the database and store the result with a TTL. The hard part is invalidation, so I delete or update keys when the underlying data changes and choose TTLs based on how stale data can be. For a product listing API, caching category pages for 60 seconds and invalidating on product updates cut database load by over half during sale traffic.

5. 5

   What is CORS and how do you configure it correctly?

   Why they ask: CORS issues are common in full stack work and often fixed insecurely.

   Sample answer: CORS is a browser mechanism that controls whether a page on one origin can read responses from another origin. The server signals allowed origins with Access-Control-Allow-Origin, and for non-simple requests the browser sends a preflight OPTIONS request first. I configure an explicit allowlist of frontend origins per environment, allow only needed methods and headers, and enable credentials only when cookies are required. Using a wildcard with credentials is not allowed and is a security risk. I once replaced a reflect-any-origin setting in an Express app with a strict allowlist during a security review.

6. 6

   Design a simple URL shortener. What components would you need?

   Why they ask: This is a common lightweight system design question for full stack roles.

   Sample answer: I would have an API to create short links and a redirect endpoint. On create, I generate a short code, for example base62 from an auto-increment ID or a random string with a uniqueness check, and store code, original URL, owner and created time in a database with an index on the code. The redirect endpoint looks up the code and returns a 301 or 302. Because reads far exceed writes, I would cache hot codes in Redis. I would add rate limiting to prevent abuse, validate URLs against malicious domains and log clicks asynchronously through a queue for analytics.

7. 7

   How do you handle errors consistently across frontend and backend?

   Why they ask: Interviewers check whether you design for failure across layers.

   Sample answer: On the backend I use a central error-handling middleware that maps known errors to proper status codes, such as 400 for validation, 401 and 403 for auth and 404 for missing resources, and returns a consistent JSON shape with a code and message. Unexpected errors return 500 without leaking stack traces and are logged with a request ID. The frontend reads the error code to show useful messages and includes the request ID in error reports. This made support much easier in my last project, because a user's screenshot with the request ID led us straight to the log entry.

8. 8

   How do you deploy your applications?

   Why they ask: Full stack roles increasingly own delivery, not just code.

   Sample answer: I containerise the frontend and backend with Docker using multi-stage builds to keep images small. A GitHub Actions pipeline runs linting, unit tests and integration tests on every pull request, then on merge builds images, pushes them to a registry and deploys to a staging environment. After smoke tests, production deploys with a rolling update so there is no downtime. Database migrations run as a separate step with backward-compatible changes. Secrets come from the cloud provider's secret manager. With this setup our team moved from monthly releases to several deploys a week.

9. 9

   Tell me about a feature you owned from database to UI.

   Why they ask: This shows end-to-end ownership and impact.

   Sample answer: At an edtech startup I built a live class scheduling feature. I designed the PostgreSQL tables for sessions, instructors and bookings with constraints to prevent double booking, wrote NestJS APIs with validation and timezone handling in UTC, and built the React calendar UI with optimistic updates. I added a background job to send reminder emails through a queue. I wrote integration tests for booking conflicts, which were the riskiest part. After launch, manual scheduling by the operations team dropped sharply, and no double-booking incidents were reported in the first quarter.

Keep going.

• React Developer Interview Questions and Answers
• Java Developer Interview Questions and Answers
• .NET Developer Interview Questions and Answers
• Node.js Job Support Online for Backend Developers
• System Design Interview Basics
• Auto Apply to Software Engineer Jobs with AI