8 questions

HTTP interview questions and answers

Junior questions

  1. 1. Which main HTTP methods do you know, and which of them are idempotent?

    Answer

    GET reads a resource, POST creates one or triggers an action, PUT replaces a resource, PATCH partially updates it, DELETE removes it. An idempotent method leaves the server in the same state whether the same request is sent once or many times. GET, PUT and DELETE are idempotent, POST is not, and PATCH in general is not either. GET and HEAD are also safe, meaning they do not change state.

    Follow-up question: How do you make a repeated POST safe, for example for a payment?

    Learn the topic in the course: HTTP and REST APIs

  2. 2. What classes of HTTP status codes are there? Give examples.

    Answer

    1xx are informational, 2xx mean success (200 OK, 201 Created, 204 No Content), 3xx are redirects (301, 302, 304 Not Modified). 4xx mean a client error: 400 bad request, 401 not authenticated, 403 access forbidden, 404 not found. 5xx mean a server error, for example 500 or 503. The right status matters because clients, caches and monitoring rely on it.

    Follow-up question: Which status do you return if the request data is well formed but breaks a business rule?

    Learn the topic in the course: HTTP and REST APIs

  3. 3. What is REST, and how do you design resource URLs properly?

    Answer

    REST is an architectural style where everything is a resource with an address, and actions on it are expressed with HTTP methods. URLs contain plural nouns, not verbs: GET /users/42, POST /users, not /getUser. Nesting shows relationships, for example /users/42/orders. The server keeps no session state between requests, each request carries everything it needs.

    Follow-up question: How would you implement pagination and filtering in a REST API?

    Learn the topic in the course: HTTP and REST APIs

  4. 4. What are the Content-Type and Accept headers for?

    Answer

    Content-Type describes the format of the message body, for example application/json or multipart/form-data, so the receiver knows how to parse it. Accept in a request tells the server which response formats the client accepts. If the server cannot return a suitable format, it responds with 406 Not Acceptable. A wrong Content-Type often means the server does not see the request body.

    Follow-up question: Which other headers do you often use in APIs?

    Learn the topic in the course: HTTP and REST APIs

  5. 5. How does PUT differ from PATCH?

    Answer

    PUT replaces the whole resource: the client sends the full representation, and fields missing from the body are treated as removed or reset. PATCH changes only the fields that are sent. PUT is idempotent by definition, PATCH is not guaranteed to be, although it is often implemented idempotently. In practice edit forms more often use PATCH.

    Follow-up question: Can you create a resource with PUT, and when does that make sense?

    Learn the topic in the course: HTTP and REST APIs

Middle questions

  1. 1. How does authentication with cookie sessions differ from tokens such as JWT?

    Answer

    With sessions the server keeps the state, and the browser sends the cookie with the session id automatically. With the HttpOnly, Secure and SameSite flags the cookie is not readable from JavaScript and is better protected against XSS and CSRF. A token is usually sent explicitly by the client in the Authorization: Bearer header, and a JWT carries signed data, so the server can verify it without a store. The downside of JWT is that revoking it before it expires is hard, so you use a short lived access token plus a refresh token.

    Follow-up question: Where is it safer to store a token in the browser, and why is localStorage risky?

    Learn the topic in the course: HTTP and REST APIs

  2. 2. What is CORS, and why does the browser send a preflight request?

    Answer

    Under the same origin policy the browser blocks reading responses from another origin, meaning a different combination of protocol, domain and port. CORS lets the server explicitly allow this with headers such as Access-Control-Allow-Origin. For non simple requests, for example with PUT, DELETE or Content-Type: application/json, the browser first sends an OPTIONS preflight and checks the allowed methods and headers. CORS only restricts browsers, server side clients ignore it.

    Follow-up question: Why can you not combine Access-Control-Allow-Origin: * with sending cookies?

    Learn the topic in the course: HTTP and REST APIs

  3. 3. How does caching work in HTTP?

    Answer

    The server controls caching with the Cache-Control header: max-age sets the freshness time, no-store forbids caching, no-cache allows caching only with revalidation, and private and public say who may cache. For revalidation the server sends an ETag or Last-Modified, and the client later sends If-None-Match or If-Modified-Since. If the resource has not changed, the server replies 304 Not Modified with no body. Static files with a hash in the name are cached for a long time with immutable.

    Follow-up question: How do you invalidate users' caches after deploying a new frontend version?

    Learn the topic in the course: HTTP and REST APIs

Train these questions

Study the cards, answer by text or voice and get an AI grade. Needs a signed in account.

Train these questions

Answer out loud and get graded

Here you get the questions with model answers. In the ShortLesson app you answer yourself, by text or voice, and AI grades the answer against the rubric and asks a follow-up, like a real interviewer.

The app is coming to the stores soon.

In the knowledge base

Reference pages for the technologies on this topic: who maintains them, when to use them and what interviews ask.

Other topics

Explore the platform