Backend interview guide

Authentication establishes identity; authorization decides which actions that identity may perform. Enforce authorization on every protected object operation.

Follow-up: What if a user changes the ID in a URL?

They separate SQL structure from bound data values. Dynamic identifiers still need allowlists; prepared values cannot safely substitute arbitrary table names.

Follow-up: How would you implement a selectable sort column?

Use a transaction when related writes must succeed or fail together, such as decreasing stock and creating an order. Choose concurrency controls for competing requests.

Follow-up: Can two requests still oversell stock?

PUT generally replaces the representation at a target resource; PATCH applies a partial modification. Document your API contract and validation rules.

Follow-up: What happens to omitted fields?

Use password_hash and password_verify with a suitable password hashing algorithm. Never store plaintext or use a fast general-purpose hash alone.

Follow-up: How do you upgrade existing password hashes?

Use deterministic ordering with a unique tie-breaker. Cursor pagination can avoid some shifting-page problems in changing datasets.

Follow-up: What happens when new rows arrive between requests?

Identify retryable operations and design idempotency where needed. For payments or orders, use a unique request key and durable result tracking.

Follow-up: Why is disabling the submit button insufficient?

Record request identifiers, outcomes and useful diagnostic context. Exclude passwords, tokens and unnecessary personal data; limit access and retention.

Follow-up: How would you investigate a failed request without exposing secrets?