Node.js Developer interview question · Most asked
How would you implement authentication in a Node.js API?
Summary
Choose sessions (server-side store + HttpOnly cookie) for browser apps or tokens (short-lived JWT access tokens + rotating refresh tokens) for APIs/mobile. Hash passwords with bcrypt/argon2, verify tokens with pinned algorithms, and enforce authorization per route and per resource.
Longer Answer
Libraries: Passport (strategies), Auth.js, Lucia-style session patterns, or identity providers (Auth0, Cognito, Keycloak). Rate-limit login, support MFA, and never store tokens in localStorage if XSS is a concern.
Key Points
- Sessions for browsers, tokens for APIs
- bcrypt/argon2 hashing
- Pin JWT algorithms, short expiry
- Authorize per resource
More most-asked Node.js Developer questions
- Why is CPU-bound work a problem in Node.js and how do you handle it?
- What are streams in Node.js and what is backpressure?
- What is the difference between `process.nextTick`, Promise microtasks, `setImmediate` and `setTimeout(fn, 0)`?
- Explain the phases of the Node.js event loop.
- What is Node.js and why is it well suited to I/O-heavy servers?
- How has asynchronous code evolved in Node.js: callbacks, Promises and async/await?
- Walk through how an Express app handles a request, including errors from async handlers.
- What are the differences between CommonJS and ES modules in Node.js?