Concepts in Backend Dev, page 27
Rust's `clap`: Build CLIs by Describing Them
clap lets you define a Rust struct representing your CLI's arguments, and it generates the parser, help text, and validation. It's used for building any Rust CLI, but its feature-richness can increase binary size over simpler alternatives.
JWTs for Stateless API Authentication
JWTs enable stateless authentication: your server verifies users via a self-contained, signed token instead of a session store. This is ideal for distributed APIs. The biggest footgun is storing refresh tokens in localStorage; use HttpOnly cookies instead.
The Builder Pattern: Constructing Complex Objects in Rust
The Builder pattern lets you construct complex objects step-by-step using a chain of method calls. It's crucial in Rust for structs with many optional fields, since the language lacks default arguments.
Sinon.JS: Isolate and Inspect Code for Unit Tests
Sinon.JS lets you replace real functions with test doubles to check *if* and *how* they were called. Use it to fake network requests or control timers. The biggest footgun is forgetting to restore fakes, which causes tests to leak state and fail unpredictably.
Heap Snapshots: Finding Node.js Memory Leaks
A heap snapshot is a photograph of your app's memory. Use it to diagnose leaks by comparing snapshots over time to see which objects grow. The big footgun: taking one freezes your app and can double memory usage, risking a crash in production.
Go's Worker Pool Pattern: Capping Concurrency
A worker pool caps concurrency by using a fixed number of goroutines to process jobs from a queue. Use it for rate-limiting API calls or processing files without spawning unlimited goroutines.
Production Secret Management: Inject, Don't Store
Treat secrets like temporary credentials, injected at runtime, not stored with your code. This applies to database passwords and API keys in production. The biggest footgun is using .env files; they are a dev convenience, not a security model.
Go's Functional Options Pattern for Flexible APIs
The functional options pattern uses functions to set optional struct fields, making APIs flexible and readable. It's common for complex constructors like servers or DB clients.
Callback Hell: The Pyramid of Doom
Callback hell is what happens when nested async callbacks indent so deeply the code forms an unreadable pyramid. You see it in legacy Node.js when chaining database queries or file reads.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.
Rust's Deref Trait: Smart Pointers Acting Like Data
The Deref trait lets a "smart pointer" type act like the data it contains, making wrappers transparent. It enables calling an inner type's methods directly on a wrapper, like using &str methods on a String. Its deref() method must never fail.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
Terminal User Interfaces (TUIs): GUIs for the Console
A TUI is a graphical interface built from text, offering rich interactivity without leaving the console. Use them for system monitoring (btop), file management, or database clients. The footgun: don't confuse them with CLIs; TUIs are stateful apps.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Rust's Tower Service: One Trait for Clients, Servers, and Middleware
Tower's Service trait is a universal API for async requests. It models any 'request -> future<response>' flow, unifying clients, servers, and middleware. Use it for HTTP servers or database clients. The footgun: ignoring poll_ready bypasses backpressure.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
The FromRequest Trait: Consuming Request Bodies in Axum
Axum's FromRequest trait defines how to create a type by consuming an HTTP request body. It's the core of extractors like Json<T> that deserialize POST data. The footgun: you can only use one FromRequest extractor per handler, as it consumes the body.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Daemonizing Go/Rust Apps: Let the OS Do It
Daemonizing an app means running it as a background service, detached from your terminal. This is essential for web servers or job processors. The common footgun is writing custom daemon logic instead of using a system service manager like systemd.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles