Easy everything in Backend Dev, page 10
Python Enums: Give Names to Magic Numbers
Python's Enum gives meaningful names to "magic numbers" or strings. Use it for fixed sets of options like statuses or categories to make code self-documenting. The footgun: don't compare members to raw values; compare member to member for type safety.
Python Packages: Grouping Modules with __init__.py
A package groups Python modules under an import name. A regular package has an __init__.py file, which runs when it is first imported. Namespace packages can omit this file. Use packages to organize related code.
Python Data Classes: Write Less Boilerplate
Python's @dataclass decorator writes boilerplate code like __init__ and __repr__ for you, turning a class with type hints into a data container. Use it for API payloads or simple records.
Python Type Hints: Documentation Your Linter Can Read
Type hints describe expected values, but Python itself does not enforce them while running. Static checkers and IDEs use the annotations before execution; libraries such as FastAPI can also inspect them for validation and API documentation.
Creating a Basic Node.js Dockerfile
A Dockerfile is a recipe for building a portable image of your app. Use it to ensure your Node.js app runs identically everywhere, from your laptop to production.
PM2: The Process Manager for Production Node.js
PM2 is a process manager that keeps your Node.js apps online. Use it to automatically restart crashed apps, run them in the background, and scale across CPU cores. The footgun is forgetting to run pm2 save to make your process list survive server reboots.
NODE_ENV: Flipping the 'Production' Switch
Setting NODE_ENV=production is like telling your Node.js app it's showtime, not rehearsal. This triggers performance optimizations in frameworks like Express, such as view caching and less verbose errors.
Socket.IO: Emitting and Handling Events
Socket.IO events are named messages sent between a client and server. One side emits a message, the other listens with on. This powers real-time apps like chat. The footgun: don't JSON.stringify objects; Socket.IO does it for you.
Socket.IO: More Than Just WebSockets
Socket.IO is a library that guarantees real-time, bidirectional communication. It automatically picks the best transport—WebSocket or HTTP long-polling—to ensure your connection works. Use it for chat apps or live dashboards.
Polling vs. WebSockets: Stop Asking, Start Listening
Polling is like repeatedly asking "Are we there yet?", while WebSockets is a persistent, two-way conversation. Use polling for infrequent updates, but use WebSockets for real-time apps like chat. The footgun is using polling for high-frequency updates.
Node.js Buffers: Handling Raw Binary Data
A Node.js Buffer is a fixed-size chunk of memory for raw binary data, like an array of bytes. Use it for file I/O or network streams where JS strings fail. The footgun is using allocUnsafe() without overwriting it, which can leak old, sensitive data.
Dependency Scanning with npm audit
Think of dependency scanning as a background check for your code. npm audit compares your project's packages against a database of known security flaws, telling you if you're using vulnerable code. The biggest footgun is blindly running npm audit fix.
Preventing SQL Injection: Never Trust User Input
To prevent SQL injection, treat SQL as a template and user input as data that can only fill placeholders, never changing the query's structure. Use this for any database query in your Node.js app that uses external data.
XSS Prevention: Context-Aware Output Encoding
Prevent XSS by encoding all untrusted data just before it's rendered. The key is context: escaping for an HTML body is different from an attribute or script tag. This is critical for displaying user content.
Chai: Assertions for Readable JavaScript Tests
Chai makes your JavaScript tests read like sentences. It provides assertion styles like expect(value).to.equal(5) to verify code behavior in test frameworks like Mocha. The main footgun: the should style fails silently on null or undefined values.
Mocha: A Flexible JavaScript Test Runner
Mocha is a flexible JavaScript test runner, providing structure but not assertions. It organizes and executes tests in Node.js and browsers, excelling with asynchronous code. The main footgun is forgetting you must pair it with an assertion library like Chai.
Jest: A Batteries-Included JavaScript Test Framework
Jest is a 'batteries-included' JavaScript test framework, bundling a runner, assertions, and mocks for a zero-config experience. It's a go-to for testing Node, React, and TypeScript apps. Footgun: Snapshot tests only catch unexpected changes, not flawed logic.
Custom Error Classes: Beyond Generic Errors
Create specific error types, like NotFoundError, instead of generic ones. This lets your code react differently to different failures, like sending a 404 for a missing user vs. a 500 for a database outage.
Error-First Callbacks: Node.js's Original Async Handler
The error-first callback is a Node.js convention: check for rain before unpacking the picnic. The first argument to any async callback is for an error. It's the standard for older core modules like fs.
Authentication vs. Authorization: Who You Are vs. What You Can Do
Authentication is proving your identity ('Who are you?'), like showing an ID. Authorization is checking your permissions ('What can you do?'), like using a key for a specific door. Systems use both on login. The footgun is treating them as the same concept.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles