Full Stack Developer question bank
100 questions. Filter by level and skill, track what you've solved, and see how many people get each one right.
- Status code after creating a resource
- Fixing a CORS error
- Where to keep a secret key
- Which method is idempotent
- fetch and error status codes
- Preventing SQL injection
- Storing user passwords
- The .env file and Git
- Status 401 vs 403
- PATCH vs PUT for one field
- What HttpOnly does
- Empty req.body in Express
- Timer vs promise order
- Optional property in strict mode
- Listing users with zero orders
- Comparing a column to NULL
- Keys for rows loaded from an API
- useState in an App Router page
- Renaming a secret to NEXT_PUBLIC_
- Undoing a commit already on main
- Docker image vs container
- Posts vanish from GET links
- What HTTPS protects
- Is browser validation enough?
- URL for a user’s orders
- What an index costs
- try/catch around an async call
- map with an async callback
- What triggers a preflight
- Dates sent through JSON
- Why commit the lockfile
- Caching a bank statement page
- Response for an empty list
- What ^3.22.4 allows
- JWT in localStorage
- The N+1 query problem
- CSRF with cookie sessions
- Server Components and the database
- Offset vs cursor pagination
- Optimistic update fails
- Renaming a column safely
- Caching hashed static files
- One failing widget breaks the dashboard
- Three awaits, three times slower
- Hiding the button is not auth
- Old title after saving
- When SameSite=Lax cookies are sent
- One schema for form and API
- Moving credits between accounts
- Composite index column order
- Search shows results for old input
- Returning form validation errors
- ETag and If-None-Match
- Rate limiter that does not limit
- Serving private invoice PDFs
- Slow Docker builds on every change
- Changed env var, old value in browser
- Users see each other’s profile
- User bios rendered as HTML
- Sensitive data inside a JWT
- Type cast on fetch response
- GraphQL author lookups
- Webhook signature always fails
- One report slows every request
- Tracing one failed checkout
- Releasing a risky checkout
- Flaky end-to-end test
- Relative fetch on the server
- Preventing double charges on retry
- Two buyers, one item left
- Refresh token rotation
- Hydration mismatch with time
- Keeping a cache in sync
- Chat across many servers
- Too many database connections
- Saving data and publishing an event
- Unique email with soft deletes
- Module variable holds the current user
- JWT algorithm confusion
- Saved profile shows old data
- Write skew under snapshot isolation
- Redirect check that can be bypassed
- Link previews fetch internal URLs
- Profile update accepts any field
- Birthday shows one day early
- Large IDs change in the browser
- 404 page returns status 200
- Cache expiry takes down the database
- Two agents edit one ticket
- Welcome email sent twice
- Items missing between pages
- Nonce-based CSP trade-off
- Comparing secret tokens safely
- Async error skips Express handler
- Choosing an API contract approach
- Errors only right after a deploy
- Designing password reset links
- OAuth for a browser-only app
- NOT IN returns no rows
- Payment call inside a transaction