Fullstack Interview Questions (with real STAR answers)

The browser resolves the domain to an IP address with DNS, opens a TCP connection, and does a TLS handshake for HTTPS. It sends an HTTP request, the server (often through a load balancer and reverse proxy) returns a response, and the browser parses the HTML, loads CSS, JavaScript, and images, builds the page, and renders it.

Cross-Origin Resource Sharing is a browser rule. By default, JavaScript on one origin cannot read responses from another origin. The server allows it by sending headers such as Access-Control-Allow-Origin. For non-simple requests the browser first sends an OPTIONS preflight request. CORS is enforced by the browser, so curl is not affected.

== compares after type conversion, so 0 == '0' is true. === compares value and type without conversion, so 0 === '0' is false. Use ===. A related trap: + with a string joins text, so '5' + 1 is '51' - convert input with Number() before doing math.

JavaScript runs one thing at a time on a single thread. Async work such as timers and network requests is handled outside, and the callbacks wait in queues. After the current code finishes, the event loop runs all microtasks (promise callbacks) first, then the next task (such as a setTimeout callback). async/await is a cleaner way to write promise code.

It tells React when to run the effect again. With no array, it runs after every render. With an empty array, it runs once after the first render. With values, it runs again when any of them change. Missing dependencies cause bugs with stale values; return a cleanup function to remove listeners or cancel requests.

Keys let React match items between renders, so it updates, moves, or removes the right elements. Use a stable unique id from the data. Using the array index can mix up state and inputs when items are added, removed, or reordered.

In a controlled component, React state holds the input value and onChange updates it, so React is the single source of truth. In an uncontrolled component, the DOM holds the value and you read it with a ref. Controlled inputs make validation and conditional UI easier.

Client-side rendering sends mostly JavaScript and builds the page in the browser. Server-side rendering builds the HTML on the server for each request, which helps the first page load and SEO. Static generation builds the HTML at build time and serves it from a CDN, which is fastest but only for content that does not change per request.

Any script on the page can read localStorage, so an XSS bug can steal the token. An httpOnly, Secure, SameSite cookie cannot be read by JavaScript, which is safer, but cookies need CSRF protection for state-changing requests. For most web apps, httpOnly cookies are the better default.

REST uses many endpoints, each returning a fixed shape, and works well with HTTP caching. GraphQL uses one endpoint where the client asks for exactly the fields it needs, which avoids over-fetching and many round trips but makes caching, rate limiting, and query cost harder to control.

Both. Frontend validation gives fast feedback to the user. Backend validation is required because anyone can call the API directly. Return a 400 with a clear message for invalid input instead of letting it crash into a 500.

Measure first with Lighthouse and the browser's Network and Performance tabs. Common improvements: split and lazy-load JavaScript, compress and resize images, serve static files from a CDN with caching headers, paginate large lists, and speed up slow API calls with indexes or caching on the backend.

Open the browser console and Network tab first. Common causes are a wrong API URL or missing environment variable in the production build, a CORS error, a wrong base path for the built files, mixed HTTP and HTTPS content, or the server not returning index.html for client-side routes.

The frontend asks the API for an upload URL. The API checks the user and file type and size, then returns a presigned URL for object storage such as S3. The browser uploads the file directly to storage, so large files do not pass through the API, and then tells the API to save the file record in the database.

Expect behavioral questions (tell me about a time you...), technical questions on JavaScript, React, HTTP, APIs, authentication, and databases, and scenario or design questions such as building a feature end to end. Many companies also give a take-home project. The questions on this page cover all of these.

Use STAR: Situation, Task, Action, Result. Keep it concrete - a specific feature or incident, what you owned, what you did, and the result. The answers above are all structured this way.