Intermediate concepts in Node.js & Express, page 3
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Preventing Sensitive Data Exposure in Node.js
Sensitive data exposure isn't just about database breaches; it's about accidentally leaking secrets. This happens when Node.js apps expose config files, API keys, or raw error messages, often by committing secrets to Git or failing to encrypt data.
Backpressure: Don't Drown Your Node.js Streams
Backpressure is flow control for streams, preventing a fast producer from overwhelming a slow consumer, like a traffic light for data. It's crucial when piping a fast file read to a slow network write. Ignoring it causes data to buffer and crash your app.
Node.js perf_hooks: A High-Precision Stopwatch for Your App
The perf_hooks module is a high-precision stopwatch for your Node.js code, offering nanosecond accuracy. Use it to benchmark async operations or HTTP request durations.
Socket.IO: Broadcasting Events to Clients
Broadcasting sends a server-side event to multiple clients at once, like a public announcement system. Use it for live notifications or game state updates. The footgun: by default, it only reaches clients on the same server; use an adapter for multi-server…
Socket.IO Rooms: Broadcasting to Subsets of Clients
Think of Socket.IO Rooms as server-side channels for grouping clients. They let you broadcast messages to a specific subset, like a private chat or users following a topic. Remember rooms are a server-only concept; a client can't see which rooms it has joined.
Socket.IO Middleware: Your Connection Gatekeeper
Socket.IO middleware is a gatekeeper for new connections, running before a client is fully connected. It's ideal for authentication, rate limiting, or logging. The key footgun: you must always call next(), or the connection will hang until it times out.
The 'ws' Library: WebSockets for Node.js Servers
The ws library is the standard for adding WebSocket servers to Node.js for real-time features like chat or live data feeds. It provides both server and client APIs for backend-to-backend communication.
Server-Sent Events (SSE): One-Way Data Push from Server
Server-Sent Events (SSE) push data from server to client over one HTTP connection. It's a simpler, one-way alternative to WebSockets for things like live news feeds or status updates.
Source-Concept Mismatch: Structured Logging
Structured logging replaces free-text console.log output with consistently shaped JSON log lines carrying fields like timestamp, level, and request id, so aggregators can filter and correlate logs by machine, not by a human grepping text.
PM2 Cluster Mode: Scale Node.js Across All Cores
PM2's cluster mode lets your Node.js app run on every CPU core, multiplying its capacity. It's essential for scaling networked apps on a single machine, but requires a stateless design—storing sessions in memory will break things as requests hit different…
Optimize Node.js Images with Multi-Stage Builds
Multi-stage builds separate your build environment from your final runtime. This lets you use heavy tools to build your Node.js app, then ship only the lean production code, drastically reducing image size and attack surface.
Environment-Specific Config: Beyond Hardcoded Values
Think of config as layered transparencies: a base file sets defaults, and environment-specific files (like production.json) override them. This keeps database hosts and feature flags tidy across dev, staging, and prod.
Health Check Endpoints: Reporting App Status
A health check is a dedicated endpoint that tells an orchestrator if your app is alive and ready for traffic. Systems like Kubernetes use it to decide whether to send traffic (readiness) or restart a container (liveness).
Non-Blocking I/O: Don't Block the Event Loop
Non-blocking I/O lets your program do other work while waiting for slow operations like network requests. It's the core of Node.js, allowing a single thread to serve many users.
package-lock.json: Your Dependency Blueprint
package-lock.json is a blueprint for your node_modules, ensuring everyone on your team installs the exact same dependency versions. It's auto-generated by npm to prevent 'works on my machine' bugs. The footgun is ignoring it or manually editing it.
Never Trust Client Input: API Validation
Think of API validation as a bouncer for your server, checking every incoming request's ID before it can access your application logic. Use it in any Express route that accepts user input to prevent bad data from hitting your database or causing errors.
Cookie-Based Sessions: Server-Side State, Client-Side ID
Think of a session cookie as a coat check ticket, not the coat itself. The server stores your data and gives you a unique ID to carry in a cookie. This is how Express.js tracks user state across requests.
Passport.js: The Gatekeeper for Your Routes
Passport.js is a gatekeeper for your Node.js routes, authenticating requests before your application logic runs. It uses pluggable "strategies" for different login types, like local passwords or Google OAuth. The footgun is misconfiguring failure handling.
JWTs for Stateless API Authentication
JWTs enable stateless authentication: your server verifies users via a self-contained, signed token instead of a session store. This is ideal for distributed APIs. The biggest footgun is storing refresh tokens in localStorage; use HttpOnly cookies instead.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles