Intermediate concepts in Backend Dev, page 7
FastAPI: Fine-Grained Permissions with OAuth2 Scopes
Think of OAuth2 scopes as permissions on a keycard. A token gets you in the building, but scopes like items:read or items:write define which rooms you can enter. Use them in FastAPI to grant granular access.
Rust's async/await: Cooperative Concurrency
Rust's async/await is cooperative concurrency, where tasks explicitly yield control with .await. This is ideal for I/O-bound work like managing thousands of network connections. The biggest footgun: calling an async function without .await does nothing.
FastAPI RBAC: Using OAuth2 Scopes for Permissions
Treat OAuth2 scopes as a list of permissions. Instead of checking a user's role, you check if their token has the required scope (e.g., items:write) for an endpoint. FastAPI's Security dependency automates this check.
Rust Async Runtimes: The Engine for `async/await`
Rust's async/await is just syntax; an async runtime like Tokio is the engine that runs the code. It polls Futures until they complete, managing I/O and scheduling. This is essential for web servers.
Point-in-Time Recovery: Rewind Your Database to a Specific Second
Point-in-Time Recovery (PITR) is a database time machine, restoring data to a specific second, not just the last snapshot. It's crucial for reversing application-level errors.
Refresh Tokens: Persistent Sessions Without Re-Authentication
A refresh token is a long-lived credential used to get a new, short-lived access token without re-authenticating. It's how apps keep you logged in for weeks. The footgun is storing it insecurely, letting attackers mint access tokens forever.
Passport.js: The Local Strategy for Username/Password Auth
Passport's Local Strategy is the bouncer for traditional username/password logins in Node.js. You provide the logic to verify credentials against your database, and Passport handles the session management.
Rust's `std::sync::Mutex`: Guarding Shared Data
A Rust Mutex guards shared data, granting access only via a temporary RAII "guard" that auto-releases the lock. It's used inside an Arc for safe multi-threaded mutation.
How Database Indexes Rot and How to Fix Them
Your database indexes rot over time, making queries slower. Frequent writes cause fragmentation (disordered pages) and low page density (half-empty pages), forcing more disk I/O.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Database Auditing: Your Database's Security Camera
Think of database auditing as a security camera for your data, recording who did what and when. It's essential for security investigations and compliance, but the footgun is treating it as a substitute for access control—it only records a breach, it doesn't…
Database Encryption: Protecting Data at Rest
Database encryption turns your data into useless gibberish for anyone without the key. It protects sensitive data at rest, like PII or financial records, from direct theft of the database files.
SQL Injection: When User Input Becomes a Command
SQL injection tricks a database into running unintended commands by sneaking them into user input. It's a common attack on websites where user data is directly stitched into SQL queries. The footgun is trusting input; always use prepared statements instead.
Custom FastAPI Middleware: The BaseHTTPMiddleware Helper
FastAPI's BaseHTTPMiddleware lets you wrap endpoints to run code before and after they execute. Use it to add custom headers or log request times. The footgun: reading request.body() in the middleware will break the endpoint, as the body can only be read…
Joi: Declarative Schemas for Data Validation
Joi lets you describe your data's shape with a readable schema instead of writing manual validation logic. It's used to validate API request bodies or config files.
Never Trust User Input: The Validation Mindset
Treat all incoming data as hostile until proven otherwise. Input validation ensures only properly formed data enters your system, protecting against errors and attacks. It applies to user forms, APIs, and partner feeds.
cargo add: Stop Editing Cargo.toml By Hand
Stop editing Cargo.toml by hand. cargo add lets you add, remove, and modify Rust dependencies from the command line. Use it to pull crates from registries, git repos, or local paths.
go vet: Catch Bugs Compilers Allow
go vet catches suspicious constructs the compiler ignores, like Printf argument mismatches. Run it in CI to spot concurrency and formatting bugs early. It relies on heuristics, so a clean report does not guarantee correctness and false positives can occur.
ORM: The Virtual Object Database Layer
ORM converts data between relational databases and object-oriented program memory, creating a virtual object database inside your code. The footgun is designing object models that ignore the relational structure, forcing awkward translations you never see.
Cargo Clippy: Your Opinionated Rust Code Reviewer
cargo clippy is an automated code reviewer that goes beyond the compiler, catching subtle bugs, performance issues, and style violations. Run it in CI to enforce idiomatic Rust.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles