Intermediate everything in Backend Dev, page 19
Socket.IO Middleware: Your Connection Gatekeeper
Socket.IO middleware is a gatekeeper for new connections, running before a client is fully connected. It's ideal for authentication, rate limiting, or logging. The key footgun: you must always call next(), or the connection will hang until it times out.
Socket.IO Rooms: Broadcasting to Subsets of Clients
Think of Socket.IO Rooms as server-side channels for grouping clients. They let you broadcast messages to a specific subset, like a private chat or users following a topic. Remember rooms are a server-only concept; a client can't see which rooms it has joined.
Socket.IO: Broadcasting Events to Clients
Broadcasting sends a server-side event to multiple clients at once, like a public announcement system. Use it for live notifications or game state updates. The footgun: by default, it only reaches clients on the same server; use an adapter for multi-server…
Node.js perf_hooks: A High-Precision Stopwatch for Your App
The perf_hooks module is a high-precision stopwatch for your Node.js code, offering nanosecond accuracy. Use it to benchmark async operations or HTTP request durations.
Backpressure: Don't Drown Your Node.js Streams
Backpressure is flow control for streams, preventing a fast producer from overwhelming a slow consumer, like a traffic light for data. It's crucial when piping a fast file read to a slow network write. Ignoring it causes data to buffer and crash your app.
Preventing Sensitive Data Exposure in Node.js
Sensitive data exposure isn't just about database breaches; it's about accidentally leaking secrets. This happens when Node.js apps expose config files, API keys, or raw error messages, often by committing secrets to Git or failing to encrypt data.
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Securing Cookies with HttpOnly, Secure, and SameSite
Think of cookie attributes as security guards for your session data. They prevent common attacks by telling the browser strict rules for sending the cookie, mitigating risks like cross-site scripting (XSS) and cross-site request forgery (CSRF).
Content Security Policy (CSP): An Allowlist for Browser Resources
Content Security Policy is an allowlist you send to the browser, dictating which scripts, styles, and images are safe to load. It's a primary defense against XSS attacks by blocking unauthorized resources.
Code Coverage Reporting with nyc/Istanbul
Code coverage reporting asks, "Which lines of my code did my tests actually run?" Use a tool like nyc to wrap your test runner (e.g., Mocha) and generate a report. The footgun is chasing 100% coverage, which doesn't guarantee quality.
Test Doubles: Mocks, Stubs, and Spies
A test double is a stand-in for a real component, letting you test code in isolation. Use them to fake slow dependencies like database calls or external APIs, making tests fast and predictable.
Supertest: Test Node.js APIs Without the Boilerplate
Supertest lets you test your Node.js API without running a separate server. Use it in Jest or Mocha to make requests to your routes and assert on responses. The footgun: since it's in-process, state can leak between tests if not reset properly.
Never Trust User Input: The Validation Mindset
Treat all incoming data as hostile until proven otherwise. Input validation ensures only properly formed data enters your system, protecting against errors and attacks. It applies to user forms, APIs, and partner feeds.
Joi: Declarative Schemas for Data Validation
Joi lets you describe your data's shape with a readable schema instead of writing manual validation logic. It's used to validate API request bodies or config files.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Passport.js: The Local Strategy for Username/Password Auth
Passport's Local Strategy is the bouncer for traditional username/password logins in Node.js. You provide the logic to verify credentials against your database, and Passport handles the session management.
Sequelize Migrations: Version Control for Your Database
Think of Sequelize migrations as Git for your database schema. Each file is a commit describing how to apply (up) and revert (down) a change. Use them to evolve your schema reliably across environments. The footgun: never edit the DB directly.
Mongoose Validation: Your Schema's Built-in Guard
Mongoose validation is a guard at the application layer, ensuring data conforms to schema rules before hitting the database. Use it for required fields, lengths, and ranges. The unique option is for database indexes, not a Mongoose validation rule.
Mongoose Middleware (Hooks): Intercepting Database Operations
Mongoose middleware (hooks) lets you intercept database operations. Think of them as "before" or "after" scripts for actions like save or find. Use them to hash passwords before saving a user.
Sequelize Associations: Who Holds the Foreign Key?
Think of Sequelize associations as rules for foreign keys. A.belongsTo(B) means A holds the bId foreign key. A.hasOne(B) or A.hasMany(B) means B holds the aId key. The footgun is mixing these up, which breaks your database schema and queries.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles