Clean Code and Best Practices Questions

Covers the principles and hands on practices that produce readable, maintainable, and reliable code. Core elements include intent revealing and consistent naming, small focused functions and classes that follow single responsibility, avoiding duplication through refactoring and appropriate abstractions, clear structure and separation of concerns, following language specific idioms and style guides, consistent formatting, concise comments that explain nonobvious intent, defensive programming and robust error handling, edge case handling and input validation, use of linters and static analysis, incremental refactoring techniques, and pragmatic trade offs between ideal design and delivery constraints. Interviewers will also probe involvement in code reviews, version control hygiene, code metrics, and how candidates advocate for and teach coding standards to peers.

MediumTechnical

73 practiced

Which code-quality metrics are useful for a frontend codebase, and how would you collect and act on them? Discuss cyclomatic complexity, duplication, test coverage, bundle size, lint violations, and other signals. Recommend tools, realistic thresholds, and how to avoid metric-driven harm.

MediumTechnical

79 practiced

Describe practical steps and code examples (JS/TS) to validate and sanitize user input to prevent XSS in a single-page app. Include recommendations for when to sanitize on the client, when to trust server-side validation, how to render user-provided HTML safely (e.g., DOMPurify), and why prefer output encoding over arbitrary input stripping.

Sample Answer

**Approach summary**Validate early, trust but verify on server, and prefer output encoding; sanitize only when you must render HTML. Client-side checks improve UX but never replace server validation.

**When to validate/sanitize**- Client: basic format & length checks (email, max length), immediate feedback.- Server: authoritative validation + sanitization; enforce ACLs and canonicalization.- Sanitize on client only for preview/UX; always re-sanitize server-side before storing/serving.

**Example: validation + sanitization (TS)**

// simple input validation (client)
function validateComment(text: string): string | null {
  if (!text.trim()) return "Empty";
  if (text.length > 5000) return "Too long";
  return null;
}

**Safe rendering of HTML (use DOMPurify)**

import DOMPurify from 'dompurify';

// when rendering user-provided HTML (e.g., preview)
const safeHtml = DOMPurify.sanitize(userHtml, {ALLOWED_TAGS: ['b','i','a','p','ul','li'], ALLOWED_ATTR: ['href','rel','target']});
// React example
<div dangerouslySetInnerHTML={{ __html: safeHtml }} />

**Why prefer output encoding**- Output encoding (HTML-escape) ensures any injection is neutralized at render time regardless of input origin.- Input stripping loses user intent and is error-prone; attackers can bypass naive filters.- Defense-in-depth: validate inputs, store raw if needed, but encode/sanitize at every output channel (HTML, JS, URL, CSS).

**Practical rules**- Use framework helpers (React escapes by default; avoid dangerouslySetInnerHTML unless sanitized).- CSP + HTTPOnly cookies + secure headers as extra layers.- Keep libraries up-to-date and limit allowed tags/attributes when sanitizing.

MediumTechnical

79 practiced

Design a concise code-review checklist tailored for frontend pull requests. The checklist should balance quality and velocity and cover readability, performance, accessibility, security, tests, bundle size, and build reliability. Explain how you'd coach reviewers to give constructive feedback on large PRs that include both feature and refactor changes.

EasyTechnical

78 practiced

Describe how to write concise comments that explain non-obvious intent rather than restating code. Given this example:

// increment i by 1i += 1;

Explain whether a comment is needed and if so how to improve it. Provide two examples where a short comment is justified and two examples where you would refactor code to remove the need for comments.

MediumTechnical

93 practiced

Explain the differences between unit, integration, and end-to-end (E2E) tests for frontend applications. Give concrete examples of what each test level should cover (e.g., component behavior, API integration, full user flows), recommend tools (Jest, React Testing Library, Cypress/Playwright), and describe how to balance the test pyramid for maintainability and speed.

Unlock Full Question Bank

Get access to hundreds of Clean Code and Best Practices interview questions and detailed answers.

Join thousands of developers preparing for their dream job.