Senior JavaScript — JavaScript interview questions

A page feels janky while scrolling. How do you diagnose it?

Record a performance profile and look at which part of the frame is over budget: script, style and layout, paint, or composite. Long tasks that block the main thread are the usual cause, and forced synchronous layout — reading a geometry property right after writing a style — is the classic self-inflicted one. Animate transform and opacity because they can be composited without layout, break long work into chunks, and move genuinely heavy computation into a Web Worker.

How do you think about XSS, CSP and the same-origin policy?

XSS is untrusted input becoming executable script, so the defence is contextual output encoding and never assembling HTML from strings — textContent over innerHTML. CSP is the second layer: it tells the browser which sources may execute, so an injection that slips through has nowhere to run. Same-origin policy is what stops another site reading your page or responses; CORS is the server deliberately relaxing it, not a security feature protecting the client.

When is a `Proxy` the right tool, and what does it cost?

It is right when you genuinely need to intercept operations you cannot enumerate ahead of time — reactivity systems, validation wrappers, mocking. It costs on every access, defeats some engine optimisations, and makes debugging harder because the object no longer behaves the way the source suggests. If a getter or a plain wrapper would do, that is the better answer.

ES modules versus CommonJS — what actually differs?

ESM is statically analysable: imports are resolved before execution, which is what makes tree shaking possible. CommonJS require is a runtime call, so a bundler cannot safely prove what is unused. ESM is also asynchronous and has live bindings, whereas require returns a snapshot of the exports object. The practical consequence is that mixing them, especially in Node, is where the sharp edges are.

How do you decide whether to add a dependency?

Weigh what it costs to ship and to maintain against what it would cost to write and own. Bundle size matters, but the bigger costs are the API surface you now depend on, the upgrade path, and what happens if it is abandoned. A small utility is usually cheaper to write than to depend on; a date library, a form library or anything touching correctness is usually cheaper to depend on than to get right yourself.