Intermediate concepts in Backend Dev, page 9
Securing Cookies with HttpOnly, Secure, and SameSite
Think of cookie attributes as security guards for your session data. They prevent common attacks by telling the browser strict rules for sending the cookie, mitigating risks like cross-site scripting (XSS) and cross-site request forgery (CSRF).
Go's `net/http`: A Production-Ready Web Server
Go's net/http package provides a powerful, production-ready web server without external frameworks. You build services by creating handlers—functions that process a request and write a response. It's ideal for APIs and microservices.
FastAPI: Documenting Additional API Responses
Document every possible API response, not just the happy path. The responses decorator parameter lets you define alternative status codes and schemas, like a 404 error model, making your OpenAPI docs complete.
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Regex Engines: Backtracking vs. Finite Automata
A backtracking regex engine tries one path at a time, which can be fast but also exponentially slow. A finite-automata engine (like Go's) checks all paths at once, guaranteeing linear time. The footgun is using a backtracking engine on untrusted user input.
Preventing Sensitive Data Exposure in Node.js
Sensitive data exposure isn't just about database breaches; it's about accidentally leaking secrets. This happens when Node.js apps expose config files, API keys, or raw error messages, often by committing secrets to Git or failing to encrypt data.
Exclude a FastAPI Endpoint from OpenAPI Docs
Hide an endpoint from your API docs by setting include_in_schema=False. Use this for internal or deprecated endpoints. The footgun: this only hides the endpoint from documentation; it remains fully functional and accessible if the URL is known.
Schema Evolution: Changing a Live Database Without Outages
Schema evolution is like renovating a house while you live in it: you must change your database's structure without breaking the live application. This is critical when adding or renaming columns.
Lambda Architecture: Batch + Stream for Big Data
Lambda Architecture handles massive datasets by combining slow, accurate batch processing with fast, real-time stream processing. It's used for analytics needing both historical and live views.
Delta Lake: Database Reliability for Your Data Lake
Delta Lake adds a transaction log to your data lake, giving you database-like reliability over raw files. This enables ACID transactions, schema enforcement, and unified batch/streaming pipelines.
Windowing: Taming Infinite Data Streams
Windowing chops infinite data streams into finite chunks for aggregation, like counting clicks per minute. It's essential for real-time dashboards, fraud detection, and IoT sensor analysis. The main footgun is mishandling late data by confusing event time vs.
Backpressure: Don't Drown Your Node.js Streams
Backpressure is flow control for streams, preventing a fast producer from overwhelming a slow consumer, like a traffic light for data. It's crucial when piping a fast file read to a slow network write. Ignoring it causes data to buffer and crash your app.
Mocking in Go: Swap Real Code for Test Doubles
Mocking in Go uses interfaces to swap slow dependencies like time.Sleep with fast fakes in tests, keeping your test suite quick. Use it for network calls or database access. The footgun is testing implementation details instead of observable behavior.
Full-Text Search: Beyond Simple String Matching
Full-text search isn't just string matching; it's a search engine for your data that understands language. Use it for e-commerce search or log analysis. The footgun is thinking a simple LIKE query is a substitute for a real search engine like Elasticsearch.
Go's pprof: Finding Your Code's Hotspots
pprof is a heat map for your code, revealing which functions consume the most CPU. It samples your program's call stacks to find performance hotspots. Use it to diagnose slow API endpoints or high-CPU background jobs. The footgun: profiling under no load.
Cache Eviction: Deciding What to Forget
A cache eviction policy is the rule for discarding data when fast-access memory is full. This is crucial for databases and CDNs. The common mistake is assuming one policy, like LRU, fits all workloads, which can cripple performance on certain access patterns.
Node.js perf_hooks: A High-Precision Stopwatch for Your App
The perf_hooks module is a high-precision stopwatch for your Node.js code, offering nanosecond accuracy. Use it to benchmark async operations or HTTP request durations.
Go Memory Profiling with pprof
pprof takes a snapshot of your Go app's memory usage, showing which functions allocate the most. Use it to diagnose high memory consumption or find leaks. A common footgun is profiling total allocations (allocs) instead of current memory use (heap).
Faceted Search: Guided Drill-Down for Large Datasets
Faceted search turns a massive result list into an interactive drill-down experience, like the filters on a shopping site. It's used in e-commerce and document libraries where items have structured attributes.
Criterion: Statistical Benchmarking for Rust
Criterion isn't just a stopwatch; it's a statistical lab for your code. It provides stable performance metrics by running functions many times, letting you detect regressions and prove optimizations. The footgun is ignoring its statistical reports.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles