JavaScript interview questions covering generators, iterators, lazy evaluation, weak collections, garbage collection, browser storage, cookies, CORS, security and runtime concepts.
Open a question for the full answer, code and interview guidance.
A generator function is declared with function* and can pause and resume its execution using the yield keyword. Calling a generator function does not immediately execute its body; it returns a generator object that implements the iterator protocol.
An iterator is any object that follows the iterator protocol by providing a next() method that returns objects containing value and done. A generator is a convenient language feature that automatically creates an iterator from a function containing yield expressions.
Lazy evaluation means values are produced only when they are requested rather than computing an entire result set in advance. Generators naturally support this because each yield can produce one value and pause until another value is requested.
WeakMap stores key-value associations where keys must be objects or non-registered symbols supported by the environment, and those keys are held weakly. WeakSet similarly stores weakly held eligible values.
Garbage collection is automatic memory management performed by the JavaScript engine. Memory occupied by objects that are no longer reachable from live application references can eventually be reclaimed.
Common causes include long-lived global references, event listeners that are never removed, timers that continue running, unbounded caches, detached DOM nodes that remain referenced, and closures that retain large objects longer than required.
Event listener cleanup means removing listeners when the component or object that owns them is no longer active. This is especially important in long-running single-page applications where UI sections may be repeatedly created and destroyed.
localStorage is a browser storage API that stores string key-value pairs for an origin. Its data normally persists across page reloads and browser sessions until explicitly removed or cleared.
Both APIs provide origin-scoped string key-value storage with a similar interface. localStorage generally persists until the data is explicitly removed, while sessionStorage is scoped to a particular browser tab or page session and is cleared when that session ends.
Cookies are small pieces of data associated with a domain and path. Depending on their attributes, cookies can be automatically included with matching HTTP requests, which makes them fundamentally different from localStorage and sessionStorage.
CORS, or Cross-Origin Resource Sharing, is an HTTP-based browser security mechanism that allows a server to indicate which other origins may access its resources through browser scripts.
The same-origin policy is a browser security boundary that restricts how a document or script from one origin can interact with resources from another origin. An origin is primarily defined by scheme, host, and port.
XSS is a web security vulnerability in which attacker-controlled content is executed as script in another user's browser under the application's origin. It can arise when untrusted data is inserted into HTML, JavaScript, URLs, or other executable contexts without appropriate output handling.
innerHTML parses assigned text as HTML. If untrusted data reaches a dangerous HTML context, an attacker may be able to inject executable markup or otherwise manipulate the document.
Content Security Policy is a browser security mechanism controlled through HTTP response headers or, in some cases, a meta element. It lets an application restrict where scripts, styles, images, frames, and other resources may be loaded from.
encodeURI is intended for encoding a complete URI while preserving characters that have structural meaning in a URI. encodeURIComponent is intended for encoding an individual URI component such as a query-string value and therefore escapes more characters.
URL provides a structured API for parsing and constructing URLs. URLSearchParams provides methods for reading, adding, updating, and deleting query-string parameters.
The try block contains code that may throw. If an exception is thrown, control moves to the matching catch block. The optional finally block runs after try/catch processing whether an error occurred or not, making it useful for cleanup.
Use the throw statement to signal an exceptional condition. It is best practice to throw Error objects, or instances of custom Error subclasses, because they provide standard fields such as name, message, and stack information.
ReferenceError commonly occurs when code tries to use an identifier that cannot be resolved. TypeError occurs when an operation is performed on a value that is not compatible with that operation, such as calling a non-function. SyntaxError indicates code or parsed input violates the required syntax.
When a catch block does not need the thrown error value, JavaScript allows the catch parameter to be omitted. This is called optional catch binding.
For objects, strict equality compares object identity rather than recursively comparing property values. Two separately created objects with identical properties are still different references and therefore are not strictly equal.
structuredClone creates a deep clone of values supported by the structured clone algorithm. It can handle many values that JSON serialization does not preserve correctly, including circular references, Map, Set, Date, and various typed data structures.
Web Workers allow JavaScript code to run in a background worker context separate from the page's main execution thread. They are useful for CPU-intensive work that would otherwise make the user interface unresponsive.
Production JavaScript should be designed for correctness, maintainability, security, performance, accessibility, and predictable failure handling. Developers should understand scope, closures, asynchronous behavior, the event loop, DOM costs, network behavior, module boundaries, and the runtime environment rather than relying only on syntax.