Core Development
Backend Development
The backend is everything the user never sees but always depends on: the server that receives a request, checks who's asking, talks to a database, and sends back the right answer — fast, securely, and correctly, even when a million people ask at once. This module takes you from writing your first server to the exact patterns production teams use: Node.js and Express remain the most-adopted backend stack in the industry, so that's the spine of this module, built up to real authentication, caching, background jobs, and security.
Topic Map
Everything in this module, at a glance
In Depth
Every topic, explained — with real-world industry context
Server Fundamentals
Before frameworks, you need to understand what a server actually is — a long-running program that listens for requests and decides how to respond, one request at a time or many at once.
Basics
- What a server is — an HTTP listener, not magic
- Node.js — the JavaScript runtime that made server-side JS mainstream
- Setting up a minimal server & routing basic requests
- Introduction to Express — routes, handlers & responses
Intermediate
- The event loop & non-blocking I/O — why Node.js handles many requests without threads
- Middleware — request/response pipelines in Express
- Project structure — organizing routes, controllers & services
- Environment configuration (.env) & config management
Advanced
- Framework alternatives — NestJS for structured, TypeScript-first backends
- Clustering & worker processes for multi-core servers
- Graceful shutdown & handling uncaught errors in production
- Choosing a runtime: Node.js vs. alternatives (Deno, Bun) — trade-offs
Real-World Industry Use Case
Node.js is the most-adopted web technology in the industry (48.7% adoption per the 2025 Stack Overflow survey), with Express the most popular framework on top of it (19.9% adoption) — this is precisely why it's the backbone of this module, not an arbitrary choice.
API Design & Implementation
This is where the "what is REST" theory from Web Fundamentals becomes real, working code — routes that a frontend (or another service) actually calls.
Basics
- Building RESTful routes — GET, POST, PUT/PATCH, DELETE
- Request & response objects — params, query strings & body
- Sending proper status codes & JSON responses
- Basic input validation
Intermediate
- Structured error handling & consistent error responses
- Request validation libraries (Zod/Joi) & sanitization
- File uploads & handling multipart form data
- API versioning strategies
Advanced
- Building a GraphQL resolver layer on top of existing REST logic
- Rate limiting & pagination for large collections
- Designing idempotent endpoints for safe retries
- API documentation (OpenAPI/Swagger) as a first-class deliverable
Real-World Industry Use Case
REST API development — routing, middleware, validation, error handling, and response formatting — is the day-to-day core of backend engineering work in 2026, whether the team is a two-person startup or a large distributed engineering org.
Authentication & Authorization
Authentication answers "who are you?" — authorization answers "what are you allowed to do?" Getting both wrong is one of the most common and costly mistakes in production software.
Basics
- Sessions & cookies — the original login model
- Password hashing — why you never store plain-text passwords
- Login/signup flow, end to end
- Protecting routes with basic middleware checks
Intermediate
- JWTs — how token-based auth actually works
- OAuth2 — logging in "with Google/GitHub"
- Role-based access control (RBAC)
- Refresh tokens & session expiry
Advanced
- Permission-based (not just role-based) access control for complex apps
- Multi-factor authentication (MFA)
- Securing APIs consumed by third parties (API keys, scopes)
- Common auth vulnerabilities & how real breaches happened
Real-World Industry Use Case
Authentication and authorization — JWT, OAuth2, hashed passwords, protected routes — are explicitly called out as core 2026 backend curriculum because nearly every real application needs user accounts, and getting this wrong is how companies end up in data-breach headlines.
Databases & ORMs — The Backend Side
The Databases & SQL module teaches the theory; this is where you actually connect a server to a database and talk to it from your own code.
Basics
- Connecting a Node.js app to a database
- Writing basic queries from application code
- Introduction to an ORM (Prisma/Sequelize) vs. raw queries
- Environment-based database configuration
Intermediate
- Schema design & migrations in an ORM
- Relationships — one-to-many & many-to-many in code
- Connecting to NoSQL (MongoDB) from a Node.js backend
- Seeding data for development & testing
Advanced
- Transactions in application code — keeping multi-step writes safe
- Connection pooling & handling database load
- N+1 query problems & how to avoid them
- Choosing SQL vs. NoSQL for a specific feature, in practice
Real-World Industry Use Case
Modern backend curricula explicitly teach both SQL (PostgreSQL) and NoSQL (MongoDB) specifically because production teams frequently use both side by side — relational data in Postgres, flexible/high-write data in Mongo — and knowing when to reach for each is a real, practical skill.
Caching & Performance
A correct backend that's too slow is still a failing backend — caching is how you avoid redoing expensive work (a slow query, an external API call) every single time.
Basics
- What caching is, and the "cache invalidation is hard" problem
- In-memory caching within a single server process
- HTTP caching headers (Cache-Control, ETag)
- When NOT to cache — data that must always be fresh
Intermediate
- Redis — a shared cache across multiple server instances
- Caching strategies: cache-aside, write-through
- CDN caching for static & semi-static content
- Measuring what's actually slow before optimizing
Advanced
- Cache stampede prevention under high load
- Rate limiting backed by Redis (sliding window, token bucket)
- Multi-layer caching strategy for a real production system
- Trade-offs between consistency and performance at scale
Real-World Industry Use Case
Redis-backed caching to reduce database load is standard practice in 2026 backend engineering — it is one of the very first tools reached for once an app has real traffic, because it is often the cheapest way to make an app feel dramatically faster.
Background Jobs & Messaging
Not every piece of work should happen inside a request-response cycle — sending an email, resizing an image, or generating a report should happen "in the background" so the user isn't stuck waiting.
Basics
- Why some work doesn't belong in the request cycle
- Simple background tasks (fire-and-forget)
- Scheduled/cron jobs — running code on a timer
- Sending emails & notifications asynchronously
Intermediate
- Job queues (BullMQ backed by Redis) — reliable, retryable background work
- Webhooks — reacting to events from external services (e.g. a payment gateway)
- Retry strategies & handling failed jobs
- Idempotency for jobs that might run more than once
Advanced
- Message brokers (RabbitMQ) for service-to-service communication
- Event-driven architecture between microservices
- Dead-letter queues & monitoring job health
- Scaling background workers independently from the API
Real-World Industry Use Case
Every "we'll email you when it's ready" feature — report generation, video processing, bulk data exports — is a background job queue in production. Payment gateways like Stripe communicate with backends almost entirely through webhooks, exactly as taught here.
Security & Production Readiness
Writing code that works is only half the job — writing code that survives real users, real load, and real attackers is what separates a tutorial project from production software.
Basics
- Input validation & sanitization (recap, applied at the API layer)
- Environment variables & never committing secrets
- Basic logging — knowing what happened after the fact
- CORS — controlling which frontends can call your API
Intermediate
- The OWASP Top 10 — the most common real-world vulnerabilities
- Preventing SQL injection & XSS at the backend layer
- Structured logging & basic monitoring/alerting
- Health checks & readiness/liveness endpoints
Advanced
- Rate limiting & abuse prevention at the API gateway level
- Secrets management in production (vaults, not .env files)
- Observability — logs, metrics & traces working together
- A pre-launch production readiness checklist, end to end
Real-World Industry Use Case
Nearly every major real-world data breach traces back to skipping one of the OWASP Top 10 basics — an unvalidated input, a missing rate limit, a secret committed to a public repo. This is precisely why "secure backend architecture" is called out as a distinct, non-optional part of every serious 2026 backend curriculum.
Ready to learn this — live?
See how this module fits into the complete curriculum.