Backend Development with Node.js

1. Node.js & the server runtime

Node.js runs JavaScript outside the browser, on a runtime built around one single thread and an event loop that makes I/O non-blocking. This lesson builds that model — what Node is, how the event loop handles thousands of connections, why blocking the thread is the cardinal sin, how modules and the file system differ from the browser, and how an HTTP server actually receives and answers a request. Understanding the runtime is what separates code that scales from code that collapses under its first concurrent users.

2. HTTP & RESTful routes

An API's routes, methods and status codes are a language your clients must be able to read without documentation. This lesson covers resource modelling, the method semantics and idempotency rules, status-code discipline, consistent response and error shapes, versioning, pagination and filtering, and the tests that pin the contract down. A predictable API is not a style preference — it is what lets every client recover from every failure without guessing.

3. Validation & error handling

Every byte a client sends is hostile until proven otherwise — including the bytes from your own front end, because anyone can call your API directly. This lesson covers the validation boundary (what to check, where, and when), schema validation as a contract, sanitisation against injection, rate limiting, error responses that help users without helping attackers, and the error-handling architecture — typed errors, one handler, structured logs — that turns failures into diagnosable events. Validation is not a form feature; it is the wall your database lives behind.

1. Database modeling

A schema is a set of promises about your data: what a row means, what must be true, and what relates to what. This lesson covers entities and keys, relationships and cardinality, normalisation as a discipline against update anomalies, constraints as enforced truth, indexing for the queries you actually run, and migrations that evolve the schema without losing what is already there. Get the model right and the code gets simpler; get it wrong and every feature carries the same structural debt.

2. Authentication & permissions

Authentication answers *who is asking*; authorisation answers *may they do this, to this thing*. This lesson covers password storage with dedicated slow hashing, session versus token designs, the cookie attributes that keep sessions safe, an authorisation matrix as a design artefact, ownership checks, OAuth and the danger zones (JWT pitfalls, reset flows, enumeration), and the endpoints that need extra armour. Getting this pair wrong is the breach — and both are enforced on the server, always.

3. Test & deploy the API

An API without automated tests is a set of promises nobody checks; a service without health checks, structured logs and a deployment pipeline is a set of promises nobody can keep at 3am. This lesson covers the test pyramid applied to APIs — contract and integration tests at the public boundary, where the value is — plus fixtures that isolate state, environments and configuration, observability (health, logs, metrics, traces), deployment mechanics with zero-downtime rollout, and the operational checklist that turns a codebase into a service.