All bites
The whole library, newest first. Filter by what you are here for, or pick a topic if you already know.
4330 bites
Page 72
Mongoose pre('save') hooks for password hashing
Pre('save') runs before persistence; use it to hash the password, guarding with isModified, calling next() or returning.
Solving the N+1 query problem in Sequelize
Define N+1 as one parent query plus one per child, detect it via SQL logging, fix with eager loading using include.
Atomic order creation with Sequelize transactions
Wrap dependent writes in sequelize.transaction, pass the transaction to each query, let managed transactions auto-commit or roll back.
MongoDB aggregation pipeline for total sales
Explain the pipeline as ordered stages, use $group with $sum to total per productId, $match on the computed total, then $sort descending.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first.
JWT structure and how the signature works
Name header, payload, and signature, note the first two are base64url-encoded not encrypted, explain the signature is computed over header and payload with a secret to detect tampering.
Session-based versus token-based authentication
Sessions store server-side state with a cookie id, tokens carry self-contained claims with no server store, weigh revocation versus scalability, especially across services.
Securing Express with Passport local strategy
Configure LocalStrategy with a verify callback, call passport.authenticate as route middleware, and set up serializeUser/deserializeUser for sessions.
Role-based access control middleware in Express
Authenticate first to set req.user, then a parameterized role-check middleware that compares req.user.role and returns 403 if it fails, applied to protected routes.
Strategies for revoking stateless JWTs
Short-lived access tokens with refresh-token rotation, or a server-side denylist of revoked token ids, weighing statelessness against immediacy.
JWT storage: localStorage versus httpOnly cookies
LocalStorage is readable by JS so XSS can steal the token but no CSRF; httpOnly cookies block XSS theft but are auto-sent, enabling CSRF unless mitigated.
Basic presence validation on a POST login route
Ensure the JSON body parser runs, destructure email and password from req.body, return 400 early if either is missing, then proceed.
Propagating async errors to Express error handlers
Express does not auto-catch rejected promises, so catch and call next(err), or wrap handlers in an asyncHandler that forwards rejections; Express 5 awaits handlers automatically.
Reusable schema validation middleware with Zod or Joi
Define a schema (email, password min 8, optional firstName), write a factory middleware that validates req.body, returns 400 with messages on failure, and assigns the parsed value on success.
Custom Error classes and centralized handling
Custom Error subclasses carry a statusCode and flag, the central handler inspects instanceof or statusCode to set the HTTP code and JSON shape, defaulting unknown errors to 500.
Operational versus programmer errors in Node.js
Operational errors are expected runtime conditions you handle and respond to; programmer errors are bugs that may corrupt state, so you log and gracefully restart.
Handling uncaughtException and unhandledRejection
Listen on process for uncaughtException and unhandledRejection, log the error, stop accepting new work, drain in-flight requests, then exit non-zero for a supervisor to restart.
Unit, integration, and E2E tests explained
Unit tests isolate one function with dependencies mocked, integration tests exercise several units together (route plus DB), E2E tests drive the whole running system.
Writing a basic Jest unit test
Import the function, group cases with describe, define each case with it or test, assert with expect and a matcher like toBe, covering normal and edge inputs.
Integration testing a POST endpoint with Supertest
Pass the Express app to supertest, send a POST with a body, then assert status 201, the response shape, and the persisted side effect; also test validation failures.