Easy everything in Backend Dev, page 10
NODE_ENV: Flipping the 'Production' Switch
Setting NODE_ENV=production is like telling your Node.js app it's showtime, not rehearsal. This triggers performance optimizations in frameworks like Express, such as view caching and less verbose errors.
Socket.IO: Emitting and Handling Events
Socket.IO events are named messages sent between a client and server. One side emits a message, the other listens with on. This powers real-time apps like chat. The footgun: don't JSON.stringify objects; Socket.IO does it for you.
Socket.IO: More Than Just WebSockets
Socket.IO is a library that guarantees real-time, bidirectional communication. It automatically picks the best transport—WebSocket or HTTP long-polling—to ensure your connection works. Use it for chat apps or live dashboards.
Polling vs. WebSockets: Stop Asking, Start Listening
Polling is like repeatedly asking "Are we there yet?", while WebSockets is a persistent, two-way conversation. Use polling for infrequent updates, but use WebSockets for real-time apps like chat. The footgun is using polling for high-frequency updates.
Node.js Buffers: Handling Raw Binary Data
A Node.js Buffer is a fixed-size chunk of memory for raw binary data, like an array of bytes. Use it for file I/O or network streams where JS strings fail. The footgun is using allocUnsafe() without overwriting it, which can leak old, sensitive data.
Dependency Scanning with npm audit
Think of dependency scanning as a background check for your code. npm audit compares your project's packages against a database of known security flaws, telling you if you're using vulnerable code. The biggest footgun is blindly running npm audit fix.
Preventing SQL Injection: Never Trust User Input
To prevent SQL injection, treat SQL as a template and user input as data that can only fill placeholders, never changing the query's structure. Use this for any database query in your Node.js app that uses external data.
XSS Prevention: Context-Aware Output Encoding
Prevent XSS by encoding all untrusted data just before it's rendered. The key is context: escaping for an HTML body is different from an attribute or script tag. This is critical for displaying user content.
Chai: Assertions for Readable JavaScript Tests
Chai makes your JavaScript tests read like sentences. It provides assertion styles like expect(value).to.equal(5) to verify code behavior in test frameworks like Mocha. The main footgun: the should style fails silently on null or undefined values.
Mocha: A Flexible JavaScript Test Runner
Mocha is a flexible JavaScript test runner, providing structure but not assertions. It organizes and executes tests in Node.js and browsers, excelling with asynchronous code. The main footgun is forgetting you must pair it with an assertion library like Chai.
Jest: A Batteries-Included JavaScript Test Framework
Jest is a 'batteries-included' JavaScript test framework, bundling a runner, assertions, and mocks for a zero-config experience. It's a go-to for testing Node, React, and TypeScript apps. Footgun: Snapshot tests only catch unexpected changes, not flawed logic.
Custom Error Classes: Beyond Generic Errors
Create specific error types, like NotFoundError, instead of generic ones. This lets your code react differently to different failures, like sending a 404 for a missing user vs. a 500 for a database outage.
Error-First Callbacks: Node.js's Original Async Handler
The error-first callback is a Node.js convention: check for rain before unpacking the picnic. The first argument to any async callback is for an error. It's the standard for older core modules like fs.
Authentication vs. Authorization: Who You Are vs. What You Can Do
Authentication is proving your identity ('Who are you?'), like showing an ID. Authorization is checking your permissions ('What can you do?'), like using a key for a specific door. Systems use both on login. The footgun is treating them as the same concept.
Connecting to MongoDB with the Native Node.js Driver
The MongoDB driver is a translator between your Node.js app and database. You create a MongoClient, point it at your database URL, and then you can execute commands. The footgun is not closing the connection, which leads to resource leaks in your application.
HTTP Status Codes: The Server's Signal
HTTP status codes are the server's signal for a request's outcome: success, client error, or server error. You see them when fetching data (200 OK), hitting a bad link (404), or when a server fails (500). Footgun: Don't just check for 'not 200'.
REST: The Architectural Style of the Web
REST is a set of design rules, not a strict protocol, for building massive distributed systems like the web. These constraints enable independent component deployment, scalable interactions, and a layered architecture that supports caching and security.
Express Middleware: Intercepting Requests Before Your Route Handler
Express middleware is like a bouncer for your routes, running code before your main handler. Use it for logging, authentication, or parsing request bodies. The biggest footgun is forgetting to call next() or send a response, which leaves requests hanging.
Express Request and Response Objects (req, res)
Think of Express's req and res as an incoming letter and your reply. req contains the client's request details, like headers and data, while res is your toolkit for sending a response. They are the core of every route handler.
Express.js: Basic Request Routing
Express routing connects a request's path and HTTP method (like GET /) to a specific handler function. This is the core of any Express app, used to define API endpoints or handle form submissions. A common mistake is using the wrong method for a request.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles