Intermediate everything in Backend Dev, page 19
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Securing Cookies with HttpOnly, Secure, and SameSite
Think of cookie attributes as security guards for your session data. They prevent common attacks by telling the browser strict rules for sending the cookie, mitigating risks like cross-site scripting (XSS) and cross-site request forgery (CSRF).
Content Security Policy (CSP): An Allowlist for Browser Resources
Content Security Policy is an allowlist you send to the browser, dictating which scripts, styles, and images are safe to load. It's a primary defense against XSS attacks by blocking unauthorized resources.
Code Coverage Reporting with nyc/Istanbul
Code coverage reporting asks, "Which lines of my code did my tests actually run?" Use a tool like nyc to wrap your test runner (e.g., Mocha) and generate a report. The footgun is chasing 100% coverage, which doesn't guarantee quality.
Test Doubles: Mocks, Stubs, and Spies
A test double is a stand-in for a real component, letting you test code in isolation. Use them to fake slow dependencies like database calls or external APIs, making tests fast and predictable.
Supertest: Test Node.js APIs Without the Boilerplate
Supertest lets you test your Node.js API without running a separate server. Use it in Jest or Mocha to make requests to your routes and assert on responses. The footgun: since it's in-process, state can leak between tests if not reset properly.
Never Trust User Input: The Validation Mindset
Treat all incoming data as hostile until proven otherwise. Input validation ensures only properly formed data enters your system, protecting against errors and attacks. It applies to user forms, APIs, and partner feeds.
Joi: Declarative Schemas for Data Validation
Joi lets you describe your data's shape with a readable schema instead of writing manual validation logic. It's used to validate API request bodies or config files.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Passport.js: The Local Strategy for Username/Password Auth
Passport's Local Strategy is the bouncer for traditional username/password logins in Node.js. You provide the logic to verify credentials against your database, and Passport handles the session management.
Sequelize Migrations: Version Control for Your Database
Think of Sequelize migrations as Git for your database schema. Each file is a commit describing how to apply (up) and revert (down) a change. Use them to evolve your schema reliably across environments. The footgun: never edit the DB directly.
Mongoose Validation: Your Schema's Built-in Guard
Mongoose validation is a guard at the application layer, ensuring data conforms to schema rules before hitting the database. Use it for required fields, lengths, and ranges. The unique option is for database indexes, not a Mongoose validation rule.
Mongoose Middleware (Hooks): Intercepting Database Operations
Mongoose middleware (hooks) lets you intercept database operations. Think of them as "before" or "after" scripts for actions like save or find. Use them to hash passwords before saving a user.
Sequelize Associations: Who Holds the Foreign Key?
Think of Sequelize associations as rules for foreign keys. A.belongsTo(B) means A holds the bId foreign key. A.hasOne(B) or A.hasMany(B) means B holds the aId key. The footgun is mixing these up, which breaks your database schema and queries.
API Pagination: Serving Big Datasets in Chunks
API pagination breaks large result sets into smaller chunks to prevent server overload. It's essential for any endpoint returning many records, like a list of users or products.
API Versioning: Managing Change Without Breaking Clients
API versioning lets you evolve an API without breaking existing clients. It's essential for public APIs or services with multiple frontends that can't update in lockstep. The footgun is delaying versioning, forcing a painful migration on early users.
Mongoose: Schemas are Blueprints, Models are Factories
A Mongoose Schema is the blueprint for your data, defining its shape and types. A Model is the factory that uses this blueprint to create, query, and save documents in MongoDB. The common footgun is trying to query the blueprint instead of the factory.
cookie-parser: From Header String to Usable Object
The cookie-parser middleware translates the raw Cookie header string into a usable req.cookies object. It's used in Express apps to read session IDs or user preferences.
Morgan: One-Line Request Logging for Express
Morgan is a plug-and-play stenographer for your Express app, automatically logging every incoming HTTP request. Use its predefined formats for quick debugging or create custom formats for production access logs.
Helmet.js: Secure Express Apps with HTTP Headers
Helmet.js adds a security layer to Express apps by setting crucial HTTP headers. Use it in any public-facing Node app to prevent common attacks like XSS. The footgun: its default Content-Security-Policy is strict and requires app-specific configuration.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles