Easy concepts in Node.js & Express, page 2
Connecting to MongoDB with the Native Node.js Driver
The MongoDB driver is a translator between your Node.js app and database. You create a MongoClient, point it at your database URL, and then you can execute commands. The footgun is not closing the connection, which leads to resource leaks in your application.
Authentication vs. Authorization: Who You Are vs. What You Can Do
Authentication is proving your identity ('Who are you?'), like showing an ID. Authorization is checking your permissions ('What can you do?'), like using a key for a specific door. Systems use both on login. The footgun is treating them as the same concept.
Error-First Callbacks: Node.js's Original Async Handler
The error-first callback is a Node.js convention: check for rain before unpacking the picnic. The first argument to any async callback is for an error. It's the standard for older core modules like fs.
Custom Error Classes: Beyond Generic Errors
Create specific error types, like NotFoundError, instead of generic ones. This lets your code react differently to different failures, like sending a 404 for a missing user vs. a 500 for a database outage.
Jest: A Batteries-Included JavaScript Test Framework
Jest is a 'batteries-included' JavaScript test framework, bundling a runner, assertions, and mocks for a zero-config experience. It's a go-to for testing Node, React, and TypeScript apps. Footgun: Snapshot tests only catch unexpected changes, not flawed logic.
Mocha: A Flexible JavaScript Test Runner
Mocha is a flexible JavaScript test runner, providing structure but not assertions. It organizes and executes tests in Node.js and browsers, excelling with asynchronous code. The main footgun is forgetting you must pair it with an assertion library like Chai.
Chai: Assertions for Readable JavaScript Tests
Chai makes your JavaScript tests read like sentences. It provides assertion styles like expect(value).to.equal(5) to verify code behavior in test frameworks like Mocha. The main footgun: the should style fails silently on null or undefined values.
XSS Prevention: Context-Aware Output Encoding
Prevent XSS by encoding all untrusted data just before it's rendered. The key is context: escaping for an HTML body is different from an attribute or script tag. This is critical for displaying user content.
Preventing SQL Injection: Never Trust User Input
To prevent SQL injection, treat SQL as a template and user input as data that can only fill placeholders, never changing the query's structure. Use this for any database query in your Node.js app that uses external data.
Dependency Scanning with npm audit
Think of dependency scanning as a background check for your code. npm audit compares your project's packages against a database of known security flaws, telling you if you're using vulnerable code. The biggest footgun is blindly running npm audit fix.
Node.js Buffers: Handling Raw Binary Data
A Node.js Buffer is a fixed-size chunk of memory for raw binary data, like an array of bytes. Use it for file I/O or network streams where JS strings fail. The footgun is using allocUnsafe() without overwriting it, which can leak old, sensitive data.
The WebSocket Protocol
WebSocket (RFC 6455) is a protocol providing full-duplex, persistent communication over a single TCP connection. It begins as an HTTP request that upgrades, then both client and server can send messages anytime, enabling real-time apps without HTTP's…
Polling vs. WebSockets: Stop Asking, Start Listening
Polling is like repeatedly asking "Are we there yet?", while WebSockets is a persistent, two-way conversation. Use polling for infrequent updates, but use WebSockets for real-time apps like chat. The footgun is using polling for high-frequency updates.
Socket.IO: More Than Just WebSockets
Socket.IO is a library that guarantees real-time, bidirectional communication. It automatically picks the best transport—WebSocket or HTTP long-polling—to ensure your connection works. Use it for chat apps or live dashboards.
Socket.IO: Emitting and Handling Events
Socket.IO events are named messages sent between a client and server. One side emits a message, the other listens with on. This powers real-time apps like chat. The footgun: don't JSON.stringify objects; Socket.IO does it for you.
NODE_ENV: Flipping the 'Production' Switch
Setting NODE_ENV=production is like telling your Node.js app it's showtime, not rehearsal. This triggers performance optimizations in frameworks like Express, such as view caching and less verbose errors.
PM2: The Process Manager for Production Node.js
PM2 is a process manager that keeps your Node.js apps online. Use it to automatically restart crashed apps, run them in the background, and scale across CPU cores. The footgun is forgetting to run pm2 save to make your process list survive server reboots.
Creating a Basic Node.js Dockerfile
A Dockerfile is a recipe for building a portable image of your app. Use it to ensure your Node.js app runs identically everywhere, from your laptop to production.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles