HTTP & REST interview questions

Methods and status semantics, caching headers, content negotiation, and HTTP/2 and HTTP/3 differences.

4 questions in Backend Engineering.

Backend EngineeringA 28-minute read on how the topic fits together, before the questions.Backend engineering fundamentals56 short answers on one page, for revising rather than studying.

medium3

mediumConceptDesignScenario

Two clients open the same record, both edit it, and the second save silently overwrites the first. How would you use ETags to turn that lost update into something the client can see and handle?

Return a strong ETag on GET, require If-Match on writes, and reject a stale token with 412 Precondition Failed so a lost update becomes a visible error rather than silent data loss. What makes it correct is that the comparison and the write must be one atomic operation - an UPDATE guarded by the version in its WHERE clause - because a SELECT then UPDATE reintroduces the race.

4 minmid, senior, staff

mediumDesignConcept

Clients are asking for page 4,000 of your /orders collection. How is that endpoint paginated, and what would you change?

Offset pagination gets slower with depth and drifts when rows are inserted mid-traversal, so paginate with a keyset comparison on the sort key plus a unique tiebreaker, hand back an opaque cursor and a Link rel=next header, and price an exact total count separately.

5 minmid, senior, staff

mediumConcept

Which status codes and method semantics do you insist on in a code review, how do the caching headers fit together, and is the API you just described REST?

Get the method's safety, idempotency and cacheability right, use the status code intermediaries and clients act on rather than a generic 200 with an error body, pair Cache-Control freshness with ETag or Last-Modified validators, and be honest that most APIs called REST are resource-shaped HTTP without hypermedia.

6 minentry, mid, senior

hard1

hardDesignConcept

Customers need to upload two-gigabyte files to your API over a flaky connection. What does that endpoint look like, and what breaks if you just accept a POST body?

A single large POST fails on the last percent and starts again, and it drags every proxy body limit and idle timeout into your critical path. Either hand out a scoped credential so bytes go straight to storage, or model the upload as a resource with a committed offset the client can resume from.

6 minmid, senior, staff