Ace your full stack interview with 10 in-depth questions spanning frontend, backend, databases, and system architecture.
I evaluate based on SEO requirements, initial load performance, and interactivity needs. SSR with frameworks like Next.js is ideal for content-heavy pages that need search engine indexing and fast first paint. CSR works well for highly interactive dashboards where the initial load trade-off is acceptable. Hybrid approaches using SSR for initial load with client-side hydration often give the best of both worlds. I also consider caching strategies and CDN compatibility for each approach.
I would structure resources around products, categories, and reviews. GET /products supports pagination, filtering by category, price range, and sorting. GET /products/:id returns detailed product info with related items. POST/PUT/DELETE endpoints require authentication with role-based access. I use consistent response envelopes with data, pagination metadata, and error objects. Rate limiting protects against abuse, and I version the API via URL path. For complex queries, I consider GraphQL to let clients request exactly the data they need.
I implement JWT-based authentication with short-lived access tokens and longer-lived refresh tokens stored in httpOnly cookies to prevent XSS attacks. Authorization uses role-based access control with middleware that validates permissions before each protected route. OAuth 2.0 handles third-party login flows. I store password hashes using bcrypt with sufficient cost factor. Session management includes token rotation on refresh and forced invalidation on password changes. CSRF protection uses the double-submit pattern.
I start with measurement using Lighthouse and Web Vitals. Common optimizations include code splitting to reduce initial bundle size, lazy loading images and non-critical components, implementing proper caching headers, and compressing assets with gzip or Brotli. On the backend, I profile database queries for N+1 problems, add appropriate indexes, and implement response caching with Redis. I use a CDN for static assets and consider server-side caching for expensive API responses. Each optimization is measured against Core Web Vitals targets.
I choose SQL databases like PostgreSQL when the data has clear relationships, requires ACID transactions, or benefits from complex queries and joins. NoSQL databases like MongoDB excel for flexible schemas, document-oriented data, and horizontal scaling needs. I consider read/write patterns, consistency requirements, and query complexity. Many modern applications benefit from polyglot persistence, using SQL for transactional data and Redis for caching, Elasticsearch for search, or DynamoDB for high-throughput key-value access.
I follow the testing pyramid: many unit tests, fewer integration tests, and selective end-to-end tests. On the frontend, I use React Testing Library for component behavior tests and Cypress or Playwright for critical user flows. Backend tests cover API endpoints with supertest, service logic with unit tests, and database interactions with integration tests against a test database. I aim for meaningful coverage rather than arbitrary percentage targets, focusing tests on business-critical paths and complex logic.
I start with local component state for UI-specific data and lift state only when siblings need to share it. For server state, React Query or SWR handles caching, refetching, and synchronization elegantly. For complex client state that multiple components need, I use Zustand or Redux Toolkit depending on team preference. Context API works for low-frequency updates like theme or auth state. The key is choosing the right tool for each type of state rather than forcing everything through one solution.
I use migration tools like Prisma Migrate, Knex, or Flyway to version-control schema changes. Every migration has an up and down function. Before production deployment, I test migrations against a copy of production data. For zero-downtime deployments, I use expand-contract patterns: add the new column, deploy code that writes to both old and new, backfill data, deploy code that reads from new, then drop the old column. I never run destructive migrations without a tested rollback plan.
Security is layered. Frontend: input sanitization, Content Security Policy headers, and XSS prevention through framework auto-escaping. API layer: input validation with schemas like Zod, rate limiting, CORS configuration, and parameterized queries to prevent SQL injection. Infrastructure: HTTPS everywhere, secrets management with tools like Vault, dependency vulnerability scanning in CI, and principle of least privilege for service accounts. I stay informed about OWASP Top 10 and conduct regular security reviews of critical code paths.
I built a real-time collaborative editing feature similar to Google Docs. The challenge was handling concurrent edits without conflicts. I implemented operational transformation on the backend with WebSocket connections for real-time sync. The frontend used a custom React hook that buffered local changes and applied remote operations. Handling cursor positions and presence indicators added complexity. The system eventually supported 50 concurrent editors with sub-200ms sync latency. I learned that distributed state synchronization requires careful design of conflict resolution rules.
PrepPilot generates full stack interview questions tailored to the specific tech stack in the job description. Practice system design, coding challenges, and behavioral questions with real-time AI feedback.
Download PrepPilot FreeReact or Next.js for frontend, Node.js or Python for backend, PostgreSQL or MongoDB for databases, and Docker/Kubernetes for deployment are most in-demand.
Yes, most mid-to-senior interviews include system design rounds covering API architecture, database schema design, caching, and scalability patterns.
Build and deploy complete projects with both frontend and backend. Include authentication, database operations, API design, and responsive UI.