Advanced concepts in Backend Dev, page 5
Send vs. Sync: Rust's Thread Safety Contracts
Send means a value can move to another thread; Sync means references to it can be shared. They are the compiler's contracts for preventing data races. The compiler checks them when you spawn threads.
CSP: Model Concurrency with Message Passing
CSP treats concurrency as isolated processes talking through channels, not threads fighting over shared memory. It shaped Go, Erlang, and occam. Engineers often retrofit shared-state patterns into channel-based code and reintroduce race conditions.
OpenID Connect (OIDC): Authentication as a Service
OIDC lets you delegate user login to a trusted third party, like "Sign in with Google." Your app gets a verifiable token saying who the user is, without handling their password. It's used for SSO in web apps.
OAuth 2.0: Delegated Authorization, Not Authentication
Think of OAuth 2.0 as a valet key for your data. It lets a third-party app access specific resources on your behalf without you sharing your password. It's used for "Log in with Google" or letting an app access your photos.
Passport.js: The Generic OAuth2 Strategy
Passport's generic OAuth2 strategy is a template for social logins, not a plug-and-play solution. Use it to integrate a custom OAuth2 provider. The footgun is using it when a provider-specific strategy (like passport-github2) exists, which handles quirks for…
Go's Memory Model: Don't Be Clever
Go guarantees your program behaves predictably—as if on one CPU—if you prevent data races. Use channels or sync primitives to serialize access when goroutines share data. The footgun is relying on timing instead of explicit synchronization.
CSRF: Double Submit Cookies for Stateless Backends
Double Submit Cookies stop CSRF by requiring a secret in two places: a cookie and a request header. The server just checks if they match. It's useful for stateless APIs where storing server-side tokens is impractical.
CSRF Tokens: Preventing Unwanted State Changes on Your Behalf
CSRF protection prevents a malicious site from forcing a user's browser to submit unwanted requests to your app. It adds a unique token to forms that the server validates. The footgun is failing to protect all state-changing endpoints, not just POST forms.
Rust's Scoped Threads: Borrowing Across Threads Safely
Scoped threads let you borrow local variables from a parent thread without complex wrappers. The scope guarantees all spawned threads are joined before it exits, satisfying the borrow checker. Use it to parallelize work on stack data.
JWT Storage: Cookies (CSRF Risk) vs. Local Storage (XSS Risk)
Storing JWTs means choosing your risk: Cross-Site Request Forgery (CSRF) with cookies, or Cross-Site Scripting (XSS) with local storage. While local storage is simpler, HttpOnly cookies are generally safer as they can't be read by client-side scripts.
Database High Availability: Surviving Server Failure
High Availability (HA) means having a hot standby database ready to take over instantly upon failure. It's essential for critical systems like payment gateways where downtime is unacceptable.
Database Disaster Recovery: Planning for Total Failure
Database Disaster Recovery (DR) assumes your primary site is gone for good, focusing on restoring service at a secondary location. It's for critical systems where regional outages are unacceptable. The footgun is confusing DR with High Availability (HA).
Database Parameter Tuning: Beyond the Defaults
Database defaults are a compromise. Parameter tuning tailors the database to your specific workload, hardware, and reliability needs. It's used to optimize memory, WAL settings, or query planning.
Node.js Uncaught Exceptions: Clean Up, Don't Continue
An uncaught exception is a fire alarm for your Node.js app, signaling an unknown state. Use the process.on('uncaughtException') hook for last-resort synchronous cleanup before exiting, not to resume normal operation.
Celery: Offloading Work from Your FastAPI App
Celery lets your web app offload slow tasks to a separate process, keeping your API responsive. Use it for tasks that can't finish in a single HTTP request, like sending bulk emails or processing images.
Active Record: Your Object is the Database Row
The Active Record pattern treats an object as a self-managing database row, bundling data with persistence logic. It's great for simple CRUD apps, but tightly couples your business logic to your database schema, making complex refactors difficult.
Rust Build Scripts: Compiling More Than Just Rust
A build.rs script is a pre-compilation hook for tasks outside Rust's scope, like compiling C code or generating Rust modules. It's essential for FFI or code generation. A key footgun: cfg! checks the host, not the target, breaking cross-compilation.
Data Mapper Pattern: Decoupling Your Domain from Your DB
A Data Mapper is a dedicated layer that moves data between in-memory objects and a database. This decouples your business logic from persistence, keeping domain objects clean and unaware of the database schema. It's the opposite of the Active Record pattern.
Rust Cargo Features: Conditional Compilation & Dependencies
Cargo features are compile-time switches for conditional compilation and optional dependencies. They let you build tailored versions of a crate from one source, like an image library that only includes code for the formats you need.
Database Proxies: A Manager for Your Database Traffic
A database proxy is a manager between your app and database, handling requests to improve performance and security. It pools connections, caches queries, and balances load, preventing any single server from being overwhelmed.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles