In this article
How the web works
The coding interview guide covers the other rounds of a loop, and this page covers the stack questions.
What happens when you type a URL and press enter?
The browser finds the server's address through the Domain Name System (DNS), sends a Hypertext Transfer Protocol (HTTP) request, usually over the Transmission Control Protocol (TCP) and Internet Protocol (IP) after a Transport Layer Security (TLS) handshake for https, receives a response and assembles the page. Mozilla's developer documentation, written by the Mozilla Developer Network (MDN) and now branded MDN Web Docs, describes the steps: a DNS lookup, an HTTP request message, a "200 OK" reply that starts the files flowing as packets, and the browser assembling them. Behind the server, the application usually queries a database before it replies.
Why it is asked: it reveals how much of the stack you can narrate end to end. Read the full explanation: MDN, how the web works.
Text description of the diagram
- The browser first asks DNS for the server's address.
- The web server queries the database and returns the response to the browser.
What is the difference between GET and POST, and what does idempotent mean?
GET is a safe, read-only method whose data travels in the URL and whose responses are cacheable by default, while POST carries a body and is not safe. An idempotent method is one where repeating the same request has the same intended effect as sending it once. Request for Comments (RFC) 9110 says PUT, DELETE and the safe methods are idempotent, so a client can retry them after a lost response, while a POST is not idempotent and a blind retry may repeat its effect.
Why it is asked: it tests retries, caching and API design. Read the full explanation: RFC 9110, section 9.2 and the representational state transfer (REST) API interview questions.
What do the HTTP status code classes mean, and how do 401 and 403 differ?
The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. A 401 means the request lacks valid authentication credentials, and the server must send a challenge. A 403 means the server understood the request but refuses it, even if credentials were given. So 401 asks who you are, and 403 says you are not allowed.
Why it is asked: confusing the two is a common sign of shallow API experience. Read the full explanation: RFC 9110, section 15.
What is CORS, and why does the browser send a preflight request?
Cross-origin resource sharing (CORS) is an HTTP-header mechanism that lets a server name other origins from which a browser may load its resources. Scripts follow the same-origin policy, so a script can read a cross-origin response only if it carries the CORS headers; a simple request itself is still sent.
A preflight request is a request using the HTTP method called OPTIONS (a query about what is allowed) that the browser sends first for any request that is not simple: a method other than GET, HEAD or POST, a non-safelisted header such as Authorization, or a Content-Type other than the three form types, such as JavaScript Object Notation (JSON). The real request follows only after the server approves, which protects older servers from requests they never expected from another origin.
Why it is asked: nearly every full stack project meets a CORS error. Read the full explanation: MDN, CORS.
The front end
How do cookies, localStorage and sessionStorage differ?
Cookies are sent to the server with every request, while the Web Storage APIs never send their data. localStorage persists after the browser is closed and reopened, while sessionStorage is kept per tab and origin and is cleared when the tab closes (MDN, Web Storage API, read 2026-10-24). MDN adds that a cookie marked HttpOnly cannot be read by page scripts, which helps against cross-site scripting, and that storage APIs hold more data than cookies, which are usually limited to about 4 KB each. Pick a cookie when the server needs the value.
Why it is asked: it tests security and performance trade-offs in one question. Read the full explanation: MDN, cookies.
Text description of the diagram
- Cookies are sent with every request.
- An HttpOnly cookie cannot be read by page scripts.
- localStorage persists after the browser is closed.
- sessionStorage is cleared when its tab closes.
- Web storage is never sent to the server.
Why does a promise callback run before a setTimeout of zero?
The event loop is the mechanism that takes jobs from queues and runs each to completion. Promise callbacks are microtasks, and MDN says the microtask queue is drained before the next task is pulled, while a timer callback is a task. In the run, the order was: start, end, promise callback, queued microtask, then the timer with a delay of zero.1
Why it is asked: it separates people who know the event loop from people who guess. Read the full explanation: MDN, the event loop and JavaScript interview questions.
Why do list items in React need keys?
A key tells React which array item each rendered component corresponds to, so it can update the page correctly when items move, are inserted or are deleted. The React documentation says keys must be unique among siblings, must not change, and should not be array indexes or random numbers, which cause subtle bugs or recreate every element on each render. Use a stable id from the data.
Why it is asked: it checks that you understand how rendering matches old and new lists. Read the full explanation: react.dev, rendering lists.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →APIs and the back end
What is the difference between REST and GraphQL?
REST exposes resources at URLs and uses HTTP methods on them, so each endpoint returns a fixed shape. GraphQL lets the client describe the data it needs in a query, and the GraphQL specification says a response contains exactly what a client asks for and no more. GraphQL saves over-fetching and extra round trips, at the cost of more server work and harder caching.
Why it is asked: it tests whether you can compare two designs by trade-off. Read the full explanation: GraphQL specification, October 2021 and REST API interview questions.
What is the difference between authentication and authorization?
Authentication establishes who a user is, and authorization decides what that user may do. The Open Worldwide Application Security Project (OWASP) Top 10:2025 lists them as separate risks: authentication failures at A07 and broken access control at A01, the first of its ten categories. A login can succeed and still expose another person's data if the server never checks ownership of each record.
Why it is asked: it separates login code from permission checks. Read the full explanation: OWASP Top 10:2025.
What is a JSON Web Token, and is its payload secret?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties, written as JSON. A signed JWT, the common form, is three base64url parts separated by dots: a header, a payload and a signature. Its payload is encoded, not encrypted. RFC 7519 also allows an encrypted JWT (a JSON Web Encryption) when the claims must be secret. In the run, a token's payload was decoded with no key at all, so anything sensitive does not belong in it; the signature only proves it was not altered.1
Why it is asked: it tests whether you confuse signing with encrypting. Read the full explanation: RFC 7519.
Why do offset-based pages repeat items, and what is the alternative?
With offset pagination the server skips a fixed number of rows, so a new row inserted at the top shifts every later page. In the run, page two repeated item 16 after one insert, while a keyset query that asks for ids below the last one seen repeated nothing.1 PostgreSQL also notes that skipped rows are still computed, so a large offset can be slow.
Why it is asked: it tests API design under changing data. Read the full explanation: PostgreSQL, limit and offset and the REST API interview questions, which include a paging example.
When would you use WebSockets instead of polling?
Use a WebSocket when the server must push messages the moment they exist and the client also sends often. MDN describes the WebSocket API as opening a two-way interactive session so you can send messages and receive responses without polling. Polling is simpler and works through any proxy but wastes requests, and server-sent events fit one-way streams.
Why it is asked: it tests choosing a transport by traffic pattern. Read the full explanation: MDN, WebSockets API.
How does HTTP caching work, and what is the difference between private and shared caches?
An HTTP cache stores a response and reuses it for later requests. A private cache belongs to one client, typically the browser, while a shared cache sits between clients and the server, as a content delivery network (CDN) or proxy does. The header Cache-Control with max-age sets how long a response stays fresh. A personalised response should be marked private, or other users may receive it.
Why it is asked: stale or leaked cached data is a classic production bug. Read the full explanation: MDN, HTTP caching.
Databases
These questions use Structured Query Language (SQL), the language most relational databases speak.
What does a database index do, and what does it cost?
An index lets the database find matching rows by walking a search structure instead of reading every row. The PostgreSQL documentation also warns that the index must be kept in step with the table, which adds overhead to inserts, updates and deletes, so unused indexes should be removed. In the run, the plan for a lookup changed from a scan of the table to a search using the index.1
Why it is asked: it tests the read-versus-write trade-off. Read the full explanation: PostgreSQL, indexes.
What is the N+1 query problem, and how do you fix it?
The N+1 query problem is code that runs one query for a list and then one more query for each row of it. With 100 authors, the loop sent 101 queries, one for the authors and one per author, and one join returned all 300 posts in a single query.1 Fix it with a join, or by fetching the related rows in one batched query, and check the query count in tests.
Why it is asked: it is a common performance bug in code that uses an object-relational mapper. Related: backend interview questions.
Text description of the diagram
- Looping over 100 authors sent 101 queries, one for the authors and one per author.
- One join returned all 300 rows in a single query.
What is a database transaction, and what does atomic mean?
A transaction is a group of steps that the database treats as one all-or-nothing operation. PostgreSQL's documentation says that, to other transactions, an atomic transaction either happens completely or not at all, and that intermediate states are not visible. In the run, a transfer that would overdraw an account failed a check, was rolled back, and left both balances at 100 and 50.1
Why it is asked: it tests reasoning about atomicity, consistency, isolation and durability (ACID) with a money example. Read the full explanation: PostgreSQL, transactions.
Security and testing
What is SQL injection, and how do you prevent it?
SQL injection is an attack in which user input is joined into a query string and is run as part of the command. OWASP lists injection as a top risk and names non-parameterised dynamic queries as a cause. In the run, the input x' OR '1'='1 returned all 3 rows with string concatenation and 0 rows as a bound parameter.1 Use parameterised queries, never string building.
Why it is asked: it is the standard test of secure data access. Read the full explanation: OWASP Top 10:2025, A05 Injection.
What are XSS and CSRF, and how do you defend against each?
Cross-site scripting (XSS) runs an attacker's script in your page, and OWASP groups it under injection. Cross-site request forgery (CSRF) makes a logged-in browser send an unwanted request, and OWASP maps it to broken access control. Escape output to prevent XSS, and mark session cookies HttpOnly so a script that does run cannot read them; against CSRF use the SameSite cookie attribute, which MDN says is treated as Lax by default (set it explicitly, since browsers have applied that default unevenly), plus anti-forgery tokens.
Why it is asked: it tests whether you know that a cookie setting is a security control. Read the full explanation: MDN, cookies and OWASP Top 10:2025.
What is the test pyramid?
The test pyramid is a way to balance tests: many small, fast unit tests at the base and fewer slow, broad tests above them. Ham Vocke's article on martinfowler.com says to write lots of small and fast unit tests, and that the more high-level a test is, the fewer of them you should have. Few end-to-end tests keep the suite fast and failures easy to locate.
Why it is asked: it shows how you protect a code base while keeping builds quick. Read the full explanation: The Practical Test Pyramid.
Follow-up questions
What do full stack developer interview questions for experienced candidates look like?
They ask for the same layers, but you are expected to describe a request end to end and the failures you have debugged: pick one request, follow it through browser, HTTP, server code and database, and rehearse the questions above aloud. The how to answer interview questions page covers structure.
Which full stack developer interview questions suit freshers?
Freshers can start with the first three groups, how the web works, the front end and APIs, because they cover what every project touches. Database and security questions add depth once those answers are fluent.
What full stack questions come up with 3 to 5 years of experience?
Expect the same topics asked for trade-offs and failures you have handled: why an index was or was not added, how you found an N+1 query, how you chose between offset and keyset pages. The backend interview questions page covers server-side depth.
What are Java full stack developer interview questions?
The web, database and security questions on this page apply unchanged; a Java role adds language and framework questions on top, which differ by employer. The coding interview guide covers the algorithm rounds.
- Narrate one request end to end: name lookup, HTTP, server, database and back.
- Know the rules, not the folklore: idempotent methods, 401 versus 403, CORS preflight, SameSite cookies.
- Measure the classic bugs: N+1 queries, offset pagination and string-built SQL.
- Cookies travel with requests and web storage does not; a JWT payload is readable by anyone.
- Keep tests mostly small and fast, with few broad ones.
Sources
- RFC 9110: HTTP Semantics (sections 9.2 and 15) — IETF (Fielding, Nottingham, Reschke, eds.; June 2022), 1 Jun 2022
- How the web works, MDN Web Docs — Mozilla (page last modified Jul 20, 2026), 20 Jul 2026
- Cross-Origin Resource Sharing (CORS), MDN Web Docs — Mozilla (page last modified Sep 4, 2026), 4 Sep 2026
- Web Storage API, MDN Web Docs — Mozilla (read 2026-10-24), 24 Oct 2026
- Using HTTP cookies, MDN Web Docs — Mozilla (page last modified Sep 17, 2026), 17 Sep 2026
- The event loop, MDN Web Docs — Mozilla (page last modified Apr 6, 2026), 6 Apr 2026
- HTTP caching, MDN Web Docs — Mozilla (page last modified Aug 14, 2026), 14 Aug 2026
- WebSockets API, MDN Web Docs — Mozilla (page last modified Oct 22, 2026), 22 Oct 2026
- Rendering Lists, react.dev — Meta Open Source (React documentation, read 2026-10-24), 24 Oct 2026
- GraphQL specification, October 2021 edition — GraphQL Foundation, 1 Oct 2021
- RFC 7519: JSON Web Token (JWT) — IETF (Jones, Bradley, Sakimura; May 2015), 1 May 2015
- PostgreSQL 18 documentation, 3.4. Transactions — PostgreSQL Global Development Group (page shows version 18.6; read 2026-10-24), 24 Oct 2026
- PostgreSQL 18 documentation, 11.1. Introduction (indexes) — PostgreSQL Global Development Group (read 2026-10-24), 24 Oct 2026
- PostgreSQL 18 documentation, 7.6. LIMIT and OFFSET — PostgreSQL Global Development Group (read 2026-10-24), 24 Oct 2026
- OWASP Top 10:2025 — OWASP Top 10 Team (edition 2025; read 2026-10-24), 24 Oct 2026
- The Practical Test Pyramid — Ham Vocke, on martinfowler.com, 26 Feb 2018
