Intermediate everything in Node.js & Express, page 5
package-lock.json: Your Dependency Blueprint
package-lock.json is a blueprint for your node_modules, ensuring everyone on your team installs the exact same dependency versions. It's auto-generated by npm to prevent 'works on my machine' bugs. The footgun is ignoring it or manually editing it.
Non-Blocking I/O: Don't Block the Event Loop
Non-blocking I/O lets your program do other work while waiting for slow operations like network requests. It's the core of Node.js, allowing a single thread to serve many users.
Health Check Endpoints: Reporting App Status
A health check is a dedicated endpoint that tells an orchestrator if your app is alive and ready for traffic. Systems like Kubernetes use it to decide whether to send traffic (readiness) or restart a container (liveness).
Environment-Specific Config: Beyond Hardcoded Values
Think of config as layered transparencies: a base file sets defaults, and environment-specific files (like production.json) override them. This keeps database hosts and feature flags tidy across dev, staging, and prod.
Optimize Node.js Images with Multi-Stage Builds
Multi-stage builds separate your build environment from your final runtime. This lets you use heavy tools to build your Node.js app, then ship only the lean production code, drastically reducing image size and attack surface.
PM2 Cluster Mode: Scale Node.js Across All Cores
PM2's cluster mode lets your Node.js app run on every CPU core, multiplying its capacity. It's essential for scaling networked apps on a single machine, but requires a stateless design—storing sessions in memory will break things as requests hit different…
Source-Concept Mismatch: Structured Logging
Structured logging replaces free-text console.log output with consistently shaped JSON log lines carrying fields like timestamp, level, and request id, so aggregators can filter and correlate logs by machine, not by a human grepping text.
Server-Sent Events (SSE): One-Way Data Push from Server
Server-Sent Events (SSE) push data from server to client over one HTTP connection. It's a simpler, one-way alternative to WebSockets for things like live news feeds or status updates.
The 'ws' Library: WebSockets for Node.js Servers
The ws library is the standard for adding WebSocket servers to Node.js for real-time features like chat or live data feeds. It provides both server and client APIs for backend-to-backend communication.
Socket.IO Middleware: Your Connection Gatekeeper
Socket.IO middleware is a gatekeeper for new connections, running before a client is fully connected. It's ideal for authentication, rate limiting, or logging. The key footgun: you must always call next(), or the connection will hang until it times out.
Socket.IO Rooms: Broadcasting to Subsets of Clients
Think of Socket.IO Rooms as server-side channels for grouping clients. They let you broadcast messages to a specific subset, like a private chat or users following a topic. Remember rooms are a server-only concept; a client can't see which rooms it has joined.
Socket.IO: Broadcasting Events to Clients
Broadcasting sends a server-side event to multiple clients at once, like a public announcement system. Use it for live notifications or game state updates. The footgun: by default, it only reaches clients on the same server; use an adapter for multi-server…
Node.js perf_hooks: A High-Precision Stopwatch for Your App
The perf_hooks module is a high-precision stopwatch for your Node.js code, offering nanosecond accuracy. Use it to benchmark async operations or HTTP request durations.
Backpressure: Don't Drown Your Node.js Streams
Backpressure is flow control for streams, preventing a fast producer from overwhelming a slow consumer, like a traffic light for data. It's crucial when piping a fast file read to a slow network write. Ignoring it causes data to buffer and crash your app.
Preventing Sensitive Data Exposure in Node.js
Sensitive data exposure isn't just about database breaches; it's about accidentally leaking secrets. This happens when Node.js apps expose config files, API keys, or raw error messages, often by committing secrets to Git or failing to encrypt data.
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Securing Cookies with HttpOnly, Secure, and SameSite
Think of cookie attributes as security guards for your session data. They prevent common attacks by telling the browser strict rules for sending the cookie, mitigating risks like cross-site scripting (XSS) and cross-site request forgery (CSRF).
Content Security Policy (CSP): An Allowlist for Browser Resources
Content Security Policy is an allowlist you send to the browser, dictating which scripts, styles, and images are safe to load. It's a primary defense against XSS attacks by blocking unauthorized resources.
Code Coverage Reporting with nyc/Istanbul
Code coverage reporting asks, "Which lines of my code did my tests actually run?" Use a tool like nyc to wrap your test runner (e.g., Mocha) and generate a report. The footgun is chasing 100% coverage, which doesn't guarantee quality.
Test Doubles: Mocks, Stubs, and Spies
A test double is a stand-in for a real component, letting you test code in isolation. Use them to fake slow dependencies like database calls or external APIs, making tests fast and predictable.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles