← J.P. Morgan Interview Insights
This one took me a minute to scope properly.
Start by explaining the goal: consistent, safe error responses across all controllers. Then describe using @ControllerAdvice with @ExceptionHandler to centralize handling, and show how to map exceptions to appropriate HTTP statuses and a standard error DTO. Finally, discuss validation errors, logging, and avoiding leakage of sensitive information.
Pro tip: Emphasize that you never expose stack traces or internal details in production, and that you log the full exception server-side with a correlation ID for traceability. Mention that you extend ResponseEntityExceptionHandler to handle Spring's built-in exceptions consistently.
Create a consistent JSON schema for errors, including fields like timestamp, status, error code, message, and path. This ensures clients can reliably parse errors.
Use @ControllerAdvice and @ExceptionHandler to catch exceptions across all controllers. Extend ResponseEntityExceptionHandler to handle Spring MVC exceptions uniformly.
For each custom exception (e.g., ResourceNotFoundException, ValidationException), define the appropriate HTTP status and a safe, user-friendly message.
Override handleMethodArgumentNotValid to extract field errors and return a structured response with details for each invalid field.
Log the full exception with a correlation ID at the server side, but return only a generic message and the correlation ID to the client to prevent exposing internals.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Explain that you use a global exception handler to catch MethodArgumentNotValidException, extract field errors from BindingResult, and map them to a structured error response. Emphasize that the response should include field name, rejected value, and message, and that you ensure consistency across all validation errors.
Pro tip: Mention that you avoid exposing internal exception details and instead use a stable error code and user-friendly message, which is crucial in regulated environments like J.P. Morgan.
Use @ControllerAdvice with @ExceptionHandler(MethodArgumentNotValidException.class) to intercept validation failures across all controllers.
From the exception's BindingResult, retrieve all FieldError objects, each containing the field name, rejected value, and default message.
Create a response object with a top-level error code, message, and a list of field errors, each with field, message, and optionally rejected value.
Respond with 400 Bad Request and include the error details in the response body, typically as JSON.
Use a standard error format across the API, avoid leaking sensitive data, and consider internationalization for messages.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by clearly defining @ControllerAdvice and @RestControllerAdvice, highlighting that @RestControllerAdvice combines @ControllerAdvice and @ResponseBody. Then explain scenarios where restricting advice to specific controllers or packages is beneficial, such as applying different exception handling or data binding rules to different API groups.
Pro tip: Mention that in large applications, global advice can lead to unintended behavior; using selectors like basePackages or annotations ensures that advice only applies where intended, improving maintainability and reducing side effects.
Explain that @ControllerAdvice is a specialization of @Component that allows global handling of exceptions, data binding, and model attributes across all controllers by default.
Explain that @RestControllerAdvice is a convenience annotation that combines @ControllerAdvice and @ResponseBody, meaning methods return values are serialized directly to the response body, ideal for REST APIs.
Highlight that both apply globally, but @RestControllerAdvice automatically adds @ResponseBody to methods, so you don't need to annotate each method with @ResponseBody.
Describe when to restrict advice: e.g., when you have multiple API versions with different error formats, when certain controllers need special exception handling, or when you want to avoid applying global advice to non-REST controllers.
Mention that you can restrict using attributes like basePackages, basePackageClasses, assignableTypes, or annotations in the @ControllerAdvice annotation.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
This caught me a little off guard because I'd been thinking purely about domain errors.
Start by acknowledging the security principle of not leaking resource existence, then describe a consistent response strategy for both authentication and authorization failures. Emphasize uniform error messages, status codes, and timing to prevent enumeration attacks, and mention logging and monitoring for security without exposing details to clients.
Pro tip: In regulated environments like J.P. Morgan, align your answer with standards like OWASP and mention compliance requirements (e.g., PCI DSS, GDPR) to show you understand the broader context. Also, highlight the importance of consistent timing to prevent side-channel attacks.
Explain that the goal is to prevent attackers from enumerating valid accounts or resources by observing differences in responses. Mention common attack vectors like brute force, credential stuffing, and resource enumeration.
Describe how to return identical error messages, HTTP status codes (e.g., 401 for both authentication and authorization failures), and response bodies regardless of whether the account or resource exists. Avoid detailed error messages that distinguish between 'invalid credentials' and 'account not found'.
Discuss the need to equalize response times to prevent timing attacks. For example, always perform a dummy password hash check even if the user doesn't exist, or introduce random delays to mask differences.
Explain that while client responses are uniform, server-side logs should capture detailed reasons for failures to aid debugging and security monitoring. Ensure logs are protected and not exposed to clients.
Mention that rate limiting and account lockout policies can mitigate enumeration attacks, but must be applied carefully to avoid denial-of-service or leaking information through lockout messages.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.
Start by defining RFC 7807 as the IETF standard for Problem Details for HTTP APIs, then explain its benefits over custom schemas: interoperability, reduced documentation, and built-in extensibility. Finally, connect it to J.P. Morgan's context by highlighting how standardization improves client integration and reduces support overhead.
Pro tip: Mention that RFC 7807 is natively supported by many frameworks (e.g., Spring, ASP.NET Core) and that adopting it can future-proof your API as tooling and client libraries increasingly expect it.
State that RFC 7807 specifies a standard JSON (or XML) format for HTTP error responses, with fields like type, title, status, detail, and instance.
Discuss how custom error schemas lead to inconsistent client handling, increased documentation, and higher integration costs for API consumers.
Emphasize interoperability, reduced boilerplate, extensibility via custom members, and better developer experience.
Explain how standardization reduces support tickets, speeds up partner onboarding, and aligns with industry best practices—critical in financial services.
Mention potential downsides like limited adoption in some legacy systems or the need to map existing errors, showing balanced judgment.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.