Full-Stack Developer Interview Guide: Questions and Answers

What interviewers expect at 4+ years, how the questions are grouped, and a one-page map of every topic.

Ownership, trade-offs, debugging stories, code review and system-design-lite questions with model answers.

Semantic HTML, the cascade, layout with flexbox and grid, container queries, stacking contexts, and common CSS traps.

Component design, hooks, rendering cost, forms, data fetching, React 19, and code-review style questions.

App Router, Server and Client Components, caching, Server Actions, proxy, rendering modes and deployment.

WCAG 2.2 criteria in plain words, forms, focus and dialogs, live regions, ARIA, contrast numbers and testing, one level past Frontend Depth Lesson 6.

Event loop, streams, workers, Express 5, security, graceful shutdown and performance.

Prisma 7, migrations, relations, transactions, N+1, raw queries, and the SQL behind it.

Cache-aside and the other patterns, TTL and invalidation, stampedes, data types, persistence, eviction, rate limiting, locks and client settings that matter.

Why queues, BullMQ, retries and backoff, dead letters, idempotency, the outbox pattern, receiving and sending webhooks, RabbitMQ vs Kafka vs SQS.

Nouns, not verbs. One error format. Ways to version an API. Idempotency keys for POST, and partial updates.

Password hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.

B-tree indexes, reading EXPLAIN ANALYZE, transactions and isolation levels, and the race conditions they stop, like selling too many items.

What a signed JWT is, how it is different from a plain session ID, and where “stateless” stops helping: logging out, expiry, refresh tokens and the claims you must check.

localStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.

Why CORS protects the browser and is not a firewall for the server, what makes a preflight request, and why you cannot use a wildcard origin together with credentials.

OAuth vs OpenID Connect, code flow with PKCE, tokens and rotation, Auth.js and Better Auth, protecting Next.js 16, RBAC, passkeys and MFA.

SSRF, path traversal, prototype pollution, ReDoS, unsafe deserialization, injection, password hashing, headers, rate limits, secrets, supply chain, uploads and a threat-model routine.

The method every answer in this series uses: which DevTools panel or server number answers which question, and how to explain your choices out loud.

The network tab says 80 ms, but users wait two seconds. Long main-thread tasks, huge JSON, many re-renders, layout thrashing and hydration cost, all linked to INP.

Follow the request: DNS and TLS, cold starts, N+1 queries, missing indexes, slow calls to other services, big payloads and missing caches. Then the UX fixes while the backend is repaired.

CORS failing only in production, random logouts, 429 errors caused by your own frontend, growing server memory and more. Each answer: find it, fix it, stop it coming back.

Detect, reduce the harm, find the cause, tell people, fix, learn. Roll back first, roles and severity, and eleven incident cases from latency that doubled overnight to a vulnerability found in production.

A 45-minute routine, a take-home checklist and six full-stack tasks with tested code.

Behavioural answers, conflict stories, salary talks, offers and the first 90 days.

A one-page, scannable resume built from the Tech Interview Handbook guide: structure, strong bullets, ATS myths versus facts, and five before-and-after rewrites.