Concepts in Backend Dev, page 16
Rust's `std::sync::Mutex`: Guarding Shared Data
A Rust Mutex guards shared data, granting access only via a temporary RAII "guard" that auto-releases the lock. It's used inside an Arc for safe multi-threaded mutation.
How Database Indexes Rot and How to Fix Them
Your database indexes rot over time, making queries slower. Frequent writes cause fragmentation (disordered pages) and low page density (half-empty pages), forcing more disk I/O.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Send vs. Sync: Rust's Thread Safety Contracts
Send means a value can move to another thread; Sync means references to it can be shared. They are the compiler's contracts for preventing data races. The compiler checks them when you spawn threads.
Database Auditing: Your Database's Security Camera
Think of database auditing as a security camera for your data, recording who did what and when. It's essential for security investigations and compliance, but the footgun is treating it as a substitute for access control—it only records a breach, it doesn't…
CSP: Model Concurrency with Message Passing
CSP treats concurrency as isolated processes talking through channels, not threads fighting over shared memory. It shaped Go, Erlang, and occam. Engineers often retrofit shared-state patterns into channel-based code and reintroduce race conditions.
OpenID Connect (OIDC): Authentication as a Service
OIDC lets you delegate user login to a trusted third party, like "Sign in with Google." Your app gets a verifiable token saying who the user is, without handling their password. It's used for SSO in web apps.
OAuth 2.0: Delegated Authorization, Not Authentication
Think of OAuth 2.0 as a valet key for your data. It lets a third-party app access specific resources on your behalf without you sharing your password. It's used for "Log in with Google" or letting an app access your photos.
Passport.js: The Generic OAuth2 Strategy
Passport's generic OAuth2 strategy is a template for social logins, not a plug-and-play solution. Use it to integrate a custom OAuth2 provider. The footgun is using it when a provider-specific strategy (like passport-github2) exists, which handles quirks for…
Go's Memory Model: Don't Be Clever
Go guarantees your program behaves predictably—as if on one CPU—if you prevent data races. Use channels or sync primitives to serialize access when goroutines share data. The footgun is relying on timing instead of explicit synchronization.
Database Encryption: Protecting Data at Rest
Database encryption turns your data into useless gibberish for anyone without the key. It protects sensitive data at rest, like PII or financial records, from direct theft of the database files.
CSRF: Double Submit Cookies for Stateless Backends
Double Submit Cookies stop CSRF by requiring a secret in two places: a cookie and a request header. The server just checks if they match. It's useful for stateless APIs where storing server-side tokens is impractical.
CSRF Tokens: Preventing Unwanted State Changes on Your Behalf
CSRF protection prevents a malicious site from forcing a user's browser to submit unwanted requests to your app. It adds a unique token to forms that the server validates. The footgun is failing to protect all state-changing endpoints, not just POST forms.
Rust's Scoped Threads: Borrowing Across Threads Safely
Scoped threads let you borrow local variables from a parent thread without complex wrappers. The scope guarantees all spawned threads are joined before it exits, satisfying the borrow checker. Use it to parallelize work on stack data.
SQL Injection: When User Input Becomes a Command
SQL injection tricks a database into running unintended commands by sneaking them into user input. It's a common attack on websites where user data is directly stitched into SQL queries. The footgun is trusting input; always use prepared statements instead.
CORSMiddleware: Unblocking Your Frontend from Your Backend
CORS is a browser security rule, not a server bug. Use FastAPI's CORSMiddleware to tell browsers which frontends (e.g., localhost:3000) are allowed to fetch data from your API (e.g., localhost:8000).
JWT Storage: Cookies (CSRF Risk) vs. Local Storage (XSS Risk)
Storing JWTs means choosing your risk: Cross-Site Request Forgery (CSRF) with cookies, or Cross-Site Scripting (XSS) with local storage. While local storage is simpler, HttpOnly cookies are generally safer as they can't be read by client-side scripts.
Go Build: From Source Code to Executable
go build is your factory for turning Go source into a runnable program. It compiles your packages and their dependencies into a single executable. Use it to create a binary for deployment, but don't confuse it with go install which puts the file in your.
Database High Availability: Surviving Server Failure
High Availability (HA) means having a hot standby database ready to take over instantly upon failure. It's essential for critical systems like payment gateways where downtime is unacceptable.
FastAPI Background Tasks: Don't Make the Client Wait
FastAPI background tasks let you run slow operations, like sending an email, *after* returning a response. This keeps your API fast. The main footgun: these are fire-and-forget; a server crash means the task is lost without a real message queue.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles