Full Stack Developer Interview Questions & Answers

In modern full stack Next.js applications, I eliminate network request waterfalls by fetching data at the server component level in parallel using `Promise.all()` rather than cascading `useEffect` calls in client components. For heavy UI widgets, I implement React Suspense with streaming SSR so critical layout and text paint immediately while slower async components stream in. Furthermore, I wrap client-heavy bundles (like charting libraries) in Next.js dynamic imports (`next/dynamic`) with `ssr: false` to keep initial JavaScript bundles under 80kB.

To prevent XSS, modern React inherently escapes JSX bindings, but when rendering user-submitted HTML, I sanitize input with DOMPurify and enforce a strict Content Security Policy (CSP) header restricting script execution to cryptographic nonces. For Cross-Site Request Forgery (CSRF), I store authentication JWTs in `HttpOnly`, `Secure`, `SameSite=Lax` or `SameSite=Strict` cookies, preventing JavaScript access and cross-domain malicious form submissions. For state-changing REST endpoints, I mandate standard anti-CSRF token verification headers.