Fifteen common full stack interview questions
- Walk me through what happens from a button click to a database write and back.
- Explain the JavaScript event loop.
- How does your frontend framework decide when to re-render?
- Where do you keep state: component, global store, server cache or URL?
- Server-side rendering versus client-side rendering?
- How do you design an API for a new feature?
- Cookies, sessions or JWTs for authentication — trade-offs?
- What are CORS and CSRF, and how do you handle them?
- How do you prevent XSS and SQL injection?
- How would you model the data for a comments feature?
- How do you make a slow page fast — on the frontend and the backend?
- How do you handle file uploads?
- How do you deploy a full stack app, and how do you roll back?
- How do you test across the stack?
- Design a small product end to end, such as a to-do app with sharing.
Frontend fundamentals
- Event loop: JavaScript runs one call stack; asynchronous callbacks wait in queues, with microtasks (promises) running before the next macrotask (timers, I/O).
- Rendering: frameworks re-render when state or props change; avoid unnecessary renders by keeping state close to where it's used and memoising expensive work.
- State placement: UI state local, server data in a caching layer, shared app state in a small store, filters in the URL.
- SSR vs CSR: SSR improves first load and SEO; CSR is simpler for apps behind login; hybrid frameworks mix both per route. See Next.js interview questions.
Auth and web security
| Topic | Interview-ready answer |
|---|---|
| Session cookies | Server-side state; easy revocation; use HttpOnly, Secure, SameSite |
| JWTs | Stateless and portable; harder to revoke; keep short-lived with refresh tokens |
| CORS | Browser rule controlling which origins can call your API; configure allowed origins explicitly |
| CSRF | Forged requests using the user's cookies; mitigate with SameSite cookies and CSRF tokens |
| XSS | Injected scripts; escape output, avoid unsafe HTML insertion, use a Content Security Policy |
| SQL injection | Use parameterised queries or an ORM correctly |
Backend and data
For a comments feature: a comments table with id, post_id, author_id, parent_id for threading, body and timestamps; an index on (post_id, created_at) for listing; cursor pagination; soft deletes so threads survive removal. Validate input, rate-limit posting, and sanitise rendering. Mention N+1 queries when loading authors and how you'd batch them. See SQL interview questions.
Performance on both sides
- Frontend: code splitting, image optimisation, caching static assets with long-lived hashed URLs, reducing JavaScript, virtualising long lists.
- Backend: indexes, avoiding N+1 queries, caching hot reads, pagination, compression.
- Measure first: browser performance tools and Core Web Vitals on the client; traces and slow query logs on the server.
The practical exercise
Take-home or live build exercises reward working software over completeness. Get a thin vertical slice running — one screen, one endpoint, one table — then add features. Write a short README covering decisions, trade-offs and what you'd do with more time, and include a few meaningful tests. Our take-home assignment guide covers the format.
Practising
Reading answers is not the same as saying them. Pick ten of the questions above and answer them aloud against a timer; a free AI interview assistant like CoPilot Interview can ask full stack questions in a mock interview and flag answers that ran long or lacked an example. Rehearse the click-to-database walkthrough until you can explain every hop in under three minutes. See also JavaScript and Node.js questions.
Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.
Frequently asked questions
What is asked in a full stack developer interview?
JavaScript and framework fundamentals, state and rendering, API design, authentication, web security (CORS, CSRF, XSS, injection), data modelling, performance, deployment, testing and often a practical build exercise.
JWT or session cookies — which is better?
Session cookies are simpler to revoke and secure by default with the right flags. JWTs are stateless and portable across services but need short lifetimes and refresh tokens. Choose based on architecture.
How deep do full stack interviews go on each layer?
Usually broad with one area of depth. Expect solid fundamentals everywhere and deeper questions in whichever side your experience emphasises.
How do I prepare for a full stack take-home?
Build a thin working slice first, then extend it; document decisions and trade-offs in a README; include meaningful tests; and keep the scope realistic.
Practise on real interview questions
Run 145 real interview questions across 10 tracks, answer out loud and see a structured answer to compare with yours. Free, no signup.
Try a practice question