HTTP & Web Servers

const http = require('node:http');

const server = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/plain' });
  res.end('Hello, World!');
});

server.listen(3000, () => console.log('Server running on port 3000'));

Common follow-ups: At what point does a project's growing complexity typically justify introducing a framework like Express over the raw http module?;What does res.writeHead() do differently from simply setting individual headers with res.setHeader()?

const http2 = require('node:http2');
const fs = require('node:fs');

const server = http2.createSecureServer({
  key: fs.readFileSync('key.pem'),
  cert: fs.readFileSync('cert.pem'),
});

server.on('stream', (stream, headers) => {
  stream.respond({ ':status': 200 });
  stream.end('Hello over HTTP/2');
});

Common follow-ups: Why does HTTP/2 in browsers effectively require TLS even though the HTTP/2 spec itself doesn't strictly mandate it?;How does adopting HTTP/2 change (or not change) how an Express application's route handlers are written?

app.get('/events', (req, res) => {
  res.set({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
  const interval = setInterval(() => {
    res.write(`data: ${JSON.stringify({ time: Date.now() })}\n\n`);
  }, 1000);
  req.on('close', () => clearInterval(interval));
});

// Client: const events = new EventSource('/events');
// events.onmessage = (e) => console.log(JSON.parse(e.data));

Common follow-ups: Why would WebSockets be a better choice than SSE if the client also needed to send frequent messages back to the server?;How do you handle cleaning up server-side resources when a client's SSE connection is closed or the browser tab is closed?

const http = require('node:http');
const agent = new http.Agent({ keepAlive: true, maxSockets: 50 });

http.get('http://api.example.com/data', { agent }, (res) => { /* reuses an existing connection if available */ });

Common follow-ups: What's the tradeoff of keeping many idle keep-alive connections open versus the overhead of repeatedly establishing new ones?;How does keep-alive interact with a load balancer in front of multiple backend server instances?

// HTTP/2 push (increasingly discouraged given browser support has been removed)
stream.pushStream({ ':path': '/style.css' }, (err, pushStream) => {
  pushStream.respond({ ':status': 200 });
  pushStream.end(cssContent);
});

// Modern alternative: 103 Early Hints, a lightweight preload suggestion
res.writeEarlyHints({ link: '</style.css>; rel=preload; as=style' });

Common follow-ups: Why specifically does server push perform poorly for a client that already has the resource cached from a previous visit?;How does the 103 Early Hints status code avoid the cache-awareness problem that made server push risky?

app.get('/users/:id', getUserHandler);       // idempotent, no side effects
app.put('/users/:id', replaceUserHandler);   // idempotent, full replacement
app.patch('/users/:id', updateUserHandler);  // partial update
app.post('/users', createUserHandler);       // NOT idempotent, creates a new resource each time
app.delete('/users/:id', deleteUserHandler); // idempotent

Common follow-ups: Why does the idempotency convention for these HTTP methods matter for how proxies and clients handle automatic retries?;How does the earlier-discussed idempotency key pattern for payments relate to this HTTP-method-level idempotency convention?

const server = http.createServer(app);
server.headersTimeout = 60000;  // max time to receive complete headers
server.requestTimeout = 300000; // max time for the entire request
server.timeout = 120000;        // socket inactivity timeout
server.listen(3000);

Common follow-ups: What's an appropriate timeout value that protects against attacks without inadvertently disconnecting legitimate slow clients (like those on poor mobile connections)?;How does a reverse proxy like Nginx sitting in front of Node.js provide an additional layer of protection against this same attack pattern?

app.get('/users/:id', (req, res) => {
  const user = getUserData(req.params.id);
  res.format({
    'application/json': () => res.json(user),
    'application/xml': () => res.send(convertToXml(user)),
    default: () => res.status(406).send('Not Acceptable'),
  });
});

Common follow-ups: How common is content negotiation in modern API design compared to simply using separate versioned or suffixed endpoints (like /users.xml)?;What other HTTP headers besides Accept participate in content negotiation, like Accept-Language?

const https = require('node:https');

const agent = new https.Agent({ keepAlive: true, maxSockets: 100, maxFreeSockets: 10 });

async function callDownstreamApi(path) {
  return fetch(`https://api.example.com${path}`, { agent }); // reuses pooled connections
}

Common follow-ups: What's the risk of setting maxSockets too high for a downstream service that has its own connection limits?;How does connection pooling behavior differ between the newer built-in fetch() and the older http/https modules in Node.js?

// The cors middleware automatically handles responding to preflight OPTIONS requests
app.use(cors({ origin: 'https://myapp.com', methods: ['GET', 'POST', TLS 'DELETE'] }));

// Express automatically routes OPTIONS requests through registered CORS middleware
// before the actual intended request (like DELETE) is ever sent by the browser

Common follow-ups: Which specific types of cross-origin requests trigger a preflight OPTIONS request, and which are considered 'simple requests' that skip it?;How would you debug a CORS issue by inspecting the actual OPTIONS preflight request and response in browser dev tools?