Question 1

Is Express still relevant in 2026 with Fastify and Hono around?

Accepted Answer

Yes — Express still has the largest middleware ecosystem on npm, is the framework most Node.js developers learn first, and runs the vast majority of Indian production APIs in 2026 (Razorpay, Swiggy, Flipkart's developer-facing services, Postman). Fastify and Hono are faster on benchmarks, but the framework is almost never the bottleneck — your database is. Express 5's native async support closed the biggest historical gap. For most teams in India, Express is the safe default; consider alternatives only after profiling shows the framework is the limit. Even at companies that have migrated parts of their stack to NestJS or Fastify, Express still powers internal tools, admin dashboards, and legacy services — so knowing it deeply is non-negotiable for any Node.js backend role in 2026.

Question 2

What does an Express.js / MERN developer earn in India?

Accepted Answer

₹6-20 LPA in 2026 for Node.js/Express backend developers, depending on experience. Freshers from bootcamps with strong MERN portfolios land at ₹4-7 LPA; mid-level (3-5 years) at ₹10-16 LPA; seniors (5+ years) at ₹15-25 LPA. Top-paying companies for Express engineers: Razorpay, Swiggy, Postman, Uber India, Flipkart, CRED. FAANG-equivalent compensation in India (Google, Microsoft) is higher but rarely uses Express specifically — they have internal stacks. Remote-first international companies pay 1.5-2x what Indian companies pay for the same skill set; a senior Node.js engineer at a US-headquartered company hiring from India typically lands ₹35-60 LPA.

Question 3

Should I learn Express 4 or Express 5 in 2026?

Accepted Answer

Start with Express 5 — the syntax is 99% the same as 4, and you avoid teaching yourself the async-error workaround patterns that Express 5 makes obsolete. However, when you join a company, expect to see Express 4 in their production codebase (most teams haven't migrated yet). Know both: build new projects on 5, but be ready to debug 4 in any role. Specifically know: how to write async error wrappers in 4, what changed with the path matcher in 5, and why `req.param()` was removed.

Question 4

What's the best way to structure a large Express project?

Accepted Answer

Feature-based folder structure: `routes/`, `controllers/`, `services/`, `models/`, `middleware/`, `validators/`, with each feature (users, orders, payments) split across these layers. Use Express `Router()` per feature module and mount them on the main app. Keep route handlers thin — they should parse input, call a service function, and return the response. Business logic lives in services, not in route handlers. For very large codebases (100+ developers), consider NestJS — it forces this separation via decorators and modules. A pattern that works well in mid-size codebases (10-30 engineers): one feature folder per domain (`features/users/`), with the route, controller, service, validator, and tests co-located.

Question 5

How is Express different from Next.js API routes?

Accepted Answer

Next.js API routes are file-based, framework-agnostic, and tied to Next.js's runtime — each file becomes a route. They're great for full-stack apps where the frontend and API ship together (the goodspace.ai webapp uses this pattern). Express is a standalone framework you run as a separate Node process — better for dedicated backend services, microservices, or cases where the API is consumed by multiple frontends (web, mobile, partners). In modern stacks, teams often use both: Next.js API routes for frontend-coupled endpoints, separate Express services for heavy backend work. Next.js API routes also support edge runtimes (Cloudflare Workers, Vercel Edge) for ultra-low-latency responses — something Express can't do natively because it depends on Node's `http` module.

Question 6

Do I need to learn TypeScript for an Express job in India?

Accepted Answer

Increasingly, yes. As of 2026, roughly 70% of new Indian Node.js job postings list TypeScript as required or strongly preferred. Most production Express codebases at Razorpay, Swiggy, and Postman are TypeScript. Learn JS first (the runtime semantics matter), then layer TypeScript on top. The Express types (`@types/express`) are mature and well-documented, and tools like `ts-node` / `tsx` make the dev loop fast. Common TypeScript patterns with Express you should know: module augmentation to type `req.user`, generic `Request` for typed handlers, and using `zod` + `z.infer<>` to derive both runtime validation and TypeScript types from a single schema.

Question 7

What is Express.js and why is it so widely used with Node.js?

Accepted Answer

Express.js is a minimalist, unopinionated web framework for Node.js, first released in 2010 by TJ Holowaychuk. It sits as a thin layer on top of Node's built-in `http` module and provides three things that raw Node lacks: a routing system (matching URLs and HTTP methods to handler functions), a middleware pipeline (a chain of functions that process each request), and helper methods on the request/response objects (`res.json`, `res.redirect`, `req.params`, etc.). It does not bundle an ORM, template engine, or auth solution — the philosophy is that you pick your own. That minimalism is exactly why it stuck: any pattern you want (REST, GraphQL, server-side rendering, WebSockets, microservices) can be built on top, and the middleware ecosystem on npm has millions of weekly downloads. In India, almost every MERN-stack tutorial and bootcamp project uses Express, so it's the single backend framework most freshers know. Express is now maintained by the OpenJS Foundation (not a single individual or company), which finally produced Express 5.0 in October 2024 after years in beta. Even with newer frameworks (Fastify, Hono, NestJS) gaining ground, Express's combination of stability, minimalism, and ecosystem maturity makes it the safe default for new Node.js services in 2026.

Question 8

How do you create a basic Express server and define routes?

Accepted Answer

Import express, call the factory to get an `app` instance, register routes for the HTTP methods you need (`app.get`, `app.post`, `app.put`, `app.delete`, `app.patch`), and start the listener with `app.listen(port)`. The route handler receives `req`, `res`, and optionally `next`. Use `res.send()`, `res.json()`, or `res.status().json()` to respond. In modern Express (4.x and 5.x), you should also use `express.json()` middleware so JSON bodies are parsed automatically into `req.body`. A few conventions every Indian Node.js team follows: put `app.listen()` in a separate `server.js` so tests can import the `app` without binding a port, always set a `PORT` environment variable (default 3000 for dev, often 5000 for production), and log the port on startup so deployment scripts can confirm the server came up. For TypeScript projects, the `Request` and `Response` types come from `@types/express` and let you type custom `req.user` and `req.body` shapes safely. The `app.all('*', handler)` pattern matches any HTTP method — useful for a catch-all 404 or universal middleware. Use `app.route('/users').get(getUsers).post(createUser)` to chain handlers for the same path with different methods, which keeps your route file tidy when one resource has several verbs.

Question 9

What is middleware in Express and how is it different from a route handler?

Accepted Answer

Middleware is any function with the signature `(req, res, next)` that Express runs as part of the request pipeline. The pipeline is ordered — every incoming request flows through middleware in the order they were registered with `app.use()` or `app.METHOD()`. A middleware can: (1) modify `req`/`res` (e.g. attach `req.user` after auth), (2) end the request by calling `res.send()`, or (3) pass control to the next middleware by calling `next()`. A route handler is technically just a special middleware tied to an HTTP method + path. The distinction is mostly conceptual: middleware tends to be cross-cutting (logging, auth, CORS), and route handlers tend to be endpoint-specific. Forgetting to call `next()` or `res.end()` is the #1 cause of hanging requests in Express — the client just waits until it times out. Middleware can be: application-level (`app.use(fn)` — every request), router-level (`router.use(fn)` — every request to that router), route-level (`app.get('/x', fn1, fn2)` — only this route), or error-handling (4-arg signature — only when `next(err)` is called). The mental model: a request walks down a tree of middleware, and each node decides whether to continue down, branch sideways (to error middleware), or terminate by sending a response.

Question 10

How do you handle path parameters and query strings in Express?

Accepted Answer

Path parameters are declared in the route with a colon prefix (`/users/:id`) and accessed via `req.params`. Query string values come from `req.query`, automatically parsed from the URL. Both are always strings — if you need a number, you convert (`Number(req.params.id)` or `parseInt`). Route parameters can also have regex constraints in Express using the syntax `/users/:id(\d+)`, which only matches numeric IDs and otherwise falls through to the next route. You can have multiple parameters in a single path (`/users/:userId/posts/:postId`) — they all show up as keys on `req.params`. For arrays in query strings, Express's default `qs` parser handles `?tag=node&tag=express` (returns an array) and bracket notation like `?filter[role]=admin&filter[status]=active` (returns a nested object), which is configurable via `app.set('query parser', 'simple')` if you want stricter parsing. Always validate before using these values in DB queries — they're attacker-controlled and the #1 source of NoSQL/SQL injection vulnerabilities in MERN apps. A common interview trick question: what's the difference between `req.params`, `req.query`, and `req.body`? They map to URL path segments, URL query string, and request body respectively — all are attacker-controlled, all are strings (or objects) by default, and all need validation. There's also `req.originalUrl` (full URL including mount path) and `req.baseUrl` (the prefix that mounted the router) — useful when writing reusable middleware that needs to know its mount point.

Question 11

What does `app.use()` do in Express?

Accepted Answer

`app.use([path], middleware)` mounts middleware on the application. With no path, the middleware runs for every incoming request. With a path, it runs only for requests whose URL starts with that path. This is the primary way to: install body parsers (`app.use(express.json())`), attach security headers (`app.use(helmet())`), mount routers (`app.use('/api/v1', apiRouter)`), and register error-handling middleware. Middleware order matters: if you register a logger BEFORE `express.json()`, it logs the raw body; if AFTER, `req.body` is already parsed. A common bug is registering `express.static('public')` AFTER an authentication middleware — that breaks public asset loading. You can also pass multiple middleware functions: `app.use(authMiddleware, rateLimitMiddleware, handler)` — they run in left-to-right order, and any one can short-circuit by responding instead of calling `next()`. The path matching for `app.use()` is prefix-based: `app.use('/api', m)` matches `/api`, `/api/users`, `/api/v1/anything` — unlike route methods which do exact matching. There's also `router.use()` (same semantics but scoped to a router) and the difference matters when nesting: `app.use('/api', apiRouter)` runs `apiRouter`'s middleware only for `/api/*` URLs. Be careful with global middleware that touches the response — for instance a 'wrap response in envelope' middleware will rewrite responses from every route, including health checks and static files. Scope it tightly to your API routes.

Question 12

What's the difference between `res.send()`, `res.json()`, and `res.end()`?

Accepted Answer

`res.end()` is the low-level method inherited from Node's `http.ServerResponse` — it closes the response stream and sends whatever was buffered. It does not set Content-Type or serialize anything. `res.send()` is Express's flexible helper: pass it a string → sets `text/html`, pass an object → it serializes to JSON and sets `application/json`, pass a Buffer → sets `application/octet-stream`. `res.json()` always serializes to JSON and sets `Content-Type: application/json`, even for strings/numbers (`res.json("hello")` sends `"hello"` as JSON). For APIs, prefer `res.json()` explicitly — it's clearer and avoids ambiguity with `res.send()` when the data type changes. `res.end()` is mostly used inside `res.write()` streaming patterns or when you want to send a status-only response (`res.status(204).end()`). A related landmine: calling `res.send()` or `res.json()` twice in the same request throws `Cannot set headers after they are sent` — usually caused by forgetting `return` after `res.json()` in a guard clause. Always `return res.json(...)` from early-exit branches. Bonus methods worth knowing: `res.sendFile(path)` streams a file with proper Content-Type, `res.redirect(url)` sends a 302 by default, `res.cookie(name, value, opts)` sets a cookie (use `httpOnly: true`, `secure: true`, `sameSite: 'strict'` for security), and `res.set(headers)` lets you add custom response headers before the body.

Question 13

How do you serve static files in Express?

Accepted Answer

Use the built-in `express.static(directory, options)` middleware. It serves files from the given directory under the mount path (or root if no path given). Express handles `Content-Type` detection, range requests (for video streaming), and conditional GETs (304 Not Modified via ETag/Last-Modified). In production, you should still front Express with nginx or a CDN — Node.js is slower at serving static files than a dedicated server, and Cloudflare/CloudFront caching offloads the work entirely. For development and small admin assets, `express.static` is plenty. Common options: `maxAge: '7d'` sets the Cache-Control header, `immutable: true` is useful for fingerprinted assets (e.g. `/static/app.abc123.js`) so browsers cache forever, and `index: false` disables the default `index.html` behavior. A frequent production bug: mounting `express.static` AFTER auth middleware so all public assets require login — always mount static-file middleware early in the chain, before auth. Security note: NEVER use user input to construct file paths passed to `express.static` or `res.sendFile` without validation — path traversal attacks (`../../etc/passwd`) are still common. The built-in middleware blocks these, but custom file serving usually doesn't. Use `path.join` with a fixed root, then verify the resolved path starts with that root before serving.

Question 14

What is the Express Router and why would you use it?

Accepted Answer

`express.Router()` is a mini-app that lets you group routes and middleware into a separate module. Each Router has its own middleware stack and route handlers, and you mount it on the main app with `app.use(prefix, router)`. This is essential for any non-trivial codebase: instead of dumping 200 routes into `index.js`, you split them by feature (`routes/users.js`, `routes/orders.js`, `routes/payments.js`), each exporting a Router. You can also attach middleware that runs only for routes in a specific router — e.g. an `authMiddleware` on the `routes/admin.js` router protects every admin endpoint without repeating it on each route. Routers can be nested too: a `v1Router` can mount a `usersRouter` at `/users`, which lets you version the API cleanly (`/api/v1/users`, `/api/v2/users`). For very large teams, the common pattern is one Router per `controller`, with the route file just wiring routes to controller methods — keeping routes thin and business logic in service modules. Routers also support `router.param('id', loadUserById)` which runs a middleware automatically whenever `:id` appears in any route on that router — handy for loading a resource once for all routes that need it. The `mergeParams: true` option on a child router lets it access path params from the parent (useful for nested resources like `/posts/:postId/comments/:commentId` where the comments router needs `postId`).

Question 15

How do you read the request body in Express?

Accepted Answer

Express 4.16+ ships with built-in body parsers: `express.json()` for JSON, `express.urlencoded({ extended: true })` for form-encoded data, and `express.raw()` / `express.text()` for raw buffers. Mount them with `app.use()` BEFORE your routes. After that, the parsed body is on `req.body`. If you don't mount the parser, `req.body` is `undefined`, which is a very common 'why is my POST broken' bug for freshers. For multipart form data (file uploads), you need a separate library — `multer` is the de-facto standard. Always set a `limit` on body parsers (default is 100kb) to prevent memory-exhaustion DoS attacks. A subtle bit: webhook handlers (Razorpay, Stripe, Slack) often need the RAW body (a Buffer) for signature verification — if you mount `express.json()` globally, the raw body is gone by the time the webhook handler runs. The fix is to mount the JSON parser AFTER the webhook routes, or use `express.raw({ type: 'application/json' })` on that specific endpoint with a `verify` callback that stashes the raw buffer on `req`. Note that in Express 5 you must explicitly mount body parsers — they're no longer included by default in some configurations. The `extended: true` option on `urlencoded` uses the `qs` library to parse nested objects (`a[b]=c` → `{ a: { b: 'c' } }`) while `extended: false` uses `querystring` (flat keys only). Stick with `extended: true` for typical form posts unless you specifically need stricter parsing.

Question 16

What is CORS and how do you enable it in Express?

Accepted Answer

CORS (Cross-Origin Resource Sharing) is a browser security mechanism: JS running on `https://app.goodspace.ai` cannot fetch `https://api.goodspace.ai` unless the API sends back the right `Access-Control-Allow-Origin` headers. Express doesn't set these by default, so cross-origin frontends get blocked. The `cors` npm package is the standard fix — mount it as middleware. Critical rule for production: never use `origin: '*'` if you also send credentials (cookies, Authorization header) — browsers explicitly forbid that combination. Instead, pass a function that validates the origin against an allowlist. Preflight requests (OPTIONS) are also handled automatically by the `cors` middleware. Note: CORS only applies to browser-initiated requests. Server-to-server calls (from your Express backend to another API) are not subject to CORS at all — that's an open misconception in interviews. Mobile apps using their native HTTP libraries are also exempt. So 'I keep getting CORS errors when I call my API from Postman' is impossible — Postman ignores CORS — meaning the user is actually testing in a browser without realizing it. Preflight requests can become a latency issue: every cross-origin POST/PUT/DELETE triggers an OPTIONS request before the real one. Set `maxAge: 86400` in the CORS config so the browser caches the preflight result for 24 hours — this saves a round trip on every subsequent request.

Express.js Interview Questions

What is Express.js and why is it so widely used with Node.js?

How do you create a basic Express server and define routes?

What is middleware in Express and how is it different from a route handler?

How do you handle path parameters and query strings in Express?

What does `app.use()` do in Express?

What's the difference between `res.send()`, `res.json()`, and `res.end()`?

How do you serve static files in Express?

What is the Express Router and why would you use it?

How do you read the request body in Express?

What is CORS and how do you enable it in Express?

How does Express match routes when there's an overlap?

What is the difference between `next()` and `next(err)`?

Why does Express error-handling middleware need exactly four arguments?

How does Express 5 handle async errors differently from Express 4?

How do you implement JWT-based authentication in Express?

How do you secure an Express app for production?

What is the full request/response lifecycle in Express?

How do you implement role-based access control (RBAC) in Express?

How do you log Express requests in production?

What is `app.locals` vs `res.locals` in Express?

How do you handle file uploads in Express?

How do you write unit and integration tests for Express apps?

How do you implement rate limiting in Express?

What is `next('route')` and when would you use it?

How do you handle 404 (not found) errors cleanly in Express?

How do you scale an Express app across multiple CPU cores using clustering or PM2?

How do you profile and optimize a slow Express endpoint in production?

How would you architect an Express microservice for 10,000+ requests per second?

How do you implement graceful shutdown in an Express app?

When should you migrate from Express to NestJS, Fastify, or Hono?

Companies Hiring Express.js

Salary Insights

Frequently Asked Questions