More in Backend Dev — page 38
OAuth 2.0: Delegated Authorization, Not Authentication
Think of OAuth 2.0 as a valet key for your data. It lets a third-party app access specific resources on your behalf without you sharing your password. It's used for "Log in with Google" or letting an app access your photos.
The Refresh Token Pattern: Stay Logged In Securely
A refresh token is like a key to a key-making machine; it mints new access tokens without re-prompting the user. This pattern keeps users logged in to web and mobile apps. The footgun: a leaked refresh token can grant an attacker indefinite access.
Passport.js: The Local Strategy for Username/Password Auth
Passport's Local Strategy is the bouncer for traditional username/password logins in Node.js. You provide the logic to verify credentials against your database, and Passport handles the session management.
Authentication vs. Authorization: Who You Are vs. What You Can Do
Authentication is proving your identity ('Who are you?'), like showing an ID. Authorization is checking your permissions ('What can you do?'), like using a key for a specific door. Systems use both on login. The footgun is treating them as the same concept.
Sequelize Scopes: Reusable Query Shortcuts
Sequelize scopes are named shortcuts for common query conditions, letting you define `where` or `include` clauses once and reuse them. Use them to keep code DRY, like an `active` scope. The footgun: a `defaultScope` is always on unless you call `.unscoped()`.
Mongoose Population: Linking Documents Across Collections
Mongoose's `populate()` acts like a client-side JOIN, replacing document IDs with actual documents from other collections. It's ideal for linking related data, like a blog post's author.
Sequelize Transactions: All-or-Nothing Database Writes
A Sequelize transaction is a safety wrapper for database queries, ensuring they all succeed or none do. Use it for multi-step operations like creating a user and profile.
Sequelize Migrations: Version Control for Your Database
Think of Sequelize migrations as Git for your database schema. Each file is a commit describing how to apply (`up`) and revert (`down`) a change. Use them to evolve your schema reliably across environments. The footgun: never edit the DB directly.
Mongoose Validation: Your Schema's Built-in Guard
Mongoose validation is a guard at the application layer, ensuring data conforms to schema rules before hitting the database. Use it for required fields, lengths, and ranges. The `unique` option is for database indexes, not a Mongoose validation rule.
Mongoose Middleware (Hooks): Intercepting Database Operations
Mongoose middleware (hooks) lets you intercept database operations. Think of them as "before" or "after" scripts for actions like `save` or `find`. Use them to hash passwords before saving a user.
Sequelize Associations: Who Holds the Foreign Key?
Think of Sequelize associations as rules for foreign keys. `A.belongsTo(B)` means `A` holds the `bId` foreign key. `A.hasOne(B)` or `A.hasMany(B)` means `B` holds the `aId` key. The footgun is mixing these up, which breaks your database schema and queries.
Connecting to MongoDB with the Native Node.js Driver
The MongoDB driver is a translator between your Node.js app and database. You create a MongoClient, point it at your database URL, and then you can execute commands. The footgun is not closing the connection, which leads to resource leaks in your application.
HATEOAS: Let Your API Tell You What's Next
HATEOAS makes an API self-discoverable, like a website where you click links instead of guessing URLs. The server's response includes links for the next possible actions, decoupling the client from hardcoded endpoints.
API Rate Limiting: Protecting Your Express Endpoints
Rate limiting acts as a bouncer for your API, preventing any single user from overwhelming it. It's crucial for public APIs and sensitive endpoints like password resets to block abuse. The default in-memory store won't work across multiple server instances.
Idempotency in REST APIs: Safe to Retry?
An idempotent API request means sending it once or 100 times has the same effect on the server's state. GET, PUT, and DELETE are idempotent, making them safe to retry. POST is not, so retrying can create duplicates.
API Pagination: Serving Big Datasets in Chunks
API pagination breaks large result sets into smaller chunks to prevent server overload. It's essential for any endpoint returning many records, like a list of users or products.
API Versioning: Managing Change Without Breaking Clients
API versioning lets you evolve an API without breaking existing clients. It's essential for public APIs or services with multiple frontends that can't update in lockstep. The footgun is delaying versioning, forcing a painful migration on early users.
Mongoose: Schemas are Blueprints, Models are Factories
A Mongoose Schema is the blueprint for your data, defining its shape and types. A Model is the factory that uses this blueprint to create, query, and save documents in MongoDB. The common footgun is trying to query the blueprint instead of the factory.
HTTP Status Codes: The Server's Signal
HTTP status codes are the server's signal for a request's outcome: success, client error, or server error. You see them when fetching data (200 OK), hitting a bad link (404), or when a server fails (500). Footgun: Don't just check for 'not 200'.
REST: The Architectural Style of the Web
REST is a set of design rules, not a strict protocol, for building massive distributed systems like the web. These constraints enable independent component deployment, scalable interactions, and a layered architecture that supports caching and security.