Backend Engineering

Servers that answer correctly under load, under retry, and under attack.

15 concepts · 590 minutes

• WebhooksInverting the call — they tell you when something happened instead of you asking forever.
• CORSThe browser rule that blocks your fetch — and why disabling it is the wrong fix.
• Storing Passwordsbcrypt/argon2, salts, and why 'we hash with SHA-256' is a breach report waiting to happen.
• Validation & InjectionNever trust the client — schema validation at the boundary, parameterised queries below it.
• The Node.js RuntimeJavaScript outside the browser: modules, streams, and a single thread doing a lot of I/O.
• Building an HTTP ServerRoutes, handlers, and the request lifecycle from socket to response.
• The Middleware PatternA pipeline of small functions around every request — auth, logging, parsing, all composable.
• WebSocketsA connection that stays open both ways — real-time, at the cost of statefulness.
• Message QueuesHand the work to someone else and answer now — the backbone of every responsive backend.
• Background JobsRetries, backoff, dead-letter queues — what happens after you say 202 Accepted.
• Sessions vs JWTsTwo ways to remember who's calling, with genuinely different failure modes — especially logout.
• IdempotencyMaking 'do it again' safe — the single idea that separates reliable distributed code from hope.
• Rate LimitingToken buckets and 429s — protecting a service from its own users and from you.
• Error HandlingExpected vs unexpected failures, and returning something the caller can actually act on.
• OAuth 2 & OpenID ConnectDelegated access done right — authorization vs authentication, and why the difference matters.