Backend & APIs
Backend work is where a project stops being a demo. These articles cover building and shaping APIs, the authentication and caching decisions that follow, and enough of the networking and deployment layer that production stops being a mystery.
Building APIs
- gRPC vs REST: When Protocol Buffers Are Worth It gRPC is faster and strongly typed, but it needs a proxy to reach a browser and its errors are harder to read in a terminal. Here is when each one actually fits. Comparison · 8 min read · September 4, 2026
- ECONNREFUSED: Why Node Can't Connect, and How to Fix It Nothing crashed in your code — the machine on the other end simply said no one's home. Here's what's actually happening on the wire, and how to fix it. Tutorial · 8 min read · September 2, 2026
- Database Connection Pooling Explained A database connection is far more expensive to open than it looks. Here's what a pool actually buys you, and the one mistake that silently exhausts it. Tutorial · 8 min read · August 29, 2026
- Prisma ORM Basics: Type-Safe Database Access for Node.js Prisma turns your database schema into a typed client, so a misspelled column fails at compile time instead of at 2am. Here is the setup and the traps beginners hit. Tutorial · 9 min read · August 24, 2026
- Idempotency: Making It Safe to Retry A client sends a payment request and the connection times out. It does not know whether the payment happened. Whether retrying is safe is entirely determined by how you built the endpoint. Tutorial · 8 min read · August 22, 2026
- API Authentication: Sessions, Tokens and Where to Store Them Every tutorial teaches JWTs and very few mention that you cannot easily log someone out. Choosing between sessions and tokens is a trade-off, and knowing which way it runs is the interesting part. Tutorial · 9 min read · August 21, 2026
- Mongoose Basics: Adding a Schema to a Schemaless Database MongoDB lets you store anything, which is convenient right up to the moment a typo creates a second field name and half your queries quietly stop matching. Tutorial · 9 min read · August 18, 2026
- Spring Boot for Students: Your First REST API in Java Spring has a reputation for configuration nightmares. Spring Boot exists specifically to remove that, and what remains is about six annotations you will use constantly. Tutorial · 9 min read · August 18, 2026
- Building Your First API with Node and Express Express is small enough to understand completely in an afternoon, which is exactly why it is a good first backend. The parts people get wrong are the same four every time. Tutorial · 9 min read · August 17, 2026
- Node Streams: Processing a 10 GB File on a 512 MB Server Reading a file into memory works until the file is bigger than your memory. Streams process it in pieces, and the memory difference is not subtle. Tutorial · 9 min read · August 16, 2026
- OAuth Explained: What 'Sign in with Google' Is Actually Doing OAuth exists to answer one question: how do you let an app act on your behalf without handing it your password? The answer is a redirect dance that looks confusing and is genuinely elegant. Tutorial · 9 min read · August 13, 2026
- Webhooks: Getting Told Instead of Asking Repeatedly Polling an API every ten seconds to ask whether a payment succeeded is wasteful and slow. A webhook reverses it: the other service calls you the moment something happens. Tutorial · 8 min read · August 13, 2026
- Rate Limiting: Stopping One Client Taking Down Your API Without a rate limit, one buggy client in a retry loop can consume everything your API has. The algorithms are simple; choosing the right one depends on whether bursts are acceptable. Tutorial · 8 min read · August 13, 2026
- Designing a REST API That Other People Can Actually Use A good API is one a developer can guess. That comes from consistency in a handful of decisions, most of which are made once and then repeated everywhere. Tutorial · 9 min read · August 13, 2026
- API Versioning: Changing Things Without Breaking Everyone Once someone else depends on your API, you cannot change it freely. Versioning is how you keep moving without breaking the code you cannot see. Tutorial · 8 min read · August 13, 2026
- API Testing With Postman: A Practical Guide The initial value of a Postman variable travels with the collection when you share it. The current value stays on your machine. Put your bearer token in the wrong box and you have just published it. Tutorial · 9 min read · August 6, 2026
- Redis Caching Basics: Cache-Aside, TTL and Invalidation A cached object comes back from Redis as JSON, so the Date you put in is now a string. The code that worked yesterday throws on line one, and only for cache hits. Tutorial · 12 min read · August 6, 2026
- WebSockets Explained: Handshake, Scaling and SSE Your chat app works perfectly until you run a second Node process behind a load balancer. Then half the messages never arrive, and nothing in the logs looks wrong. Tutorial · 12 min read · August 6, 2026
- ESM vs CommonJS: import, require and the type Field Adding one line to package.json can break every require in your project at once. Here is what the two module systems actually are and where they refuse to meet. Comparison · 12 min read · August 6, 2026
- Python JSON: load vs loads, and the Traps Between json.dumps on a datetime raises TypeError, and the default settings turn Hindi text into a wall of backslash-u escapes. Four functions, a handful of arguments, and a surprising number of ways to lose data. Tutorial · 10 min read · August 6, 2026
- EADDRINUSE: Port Already in Use and How to Fix It The process holding port 3000 is almost always your own server from ten minutes ago. Killing it blindly is the wrong habit; finding it takes one command. Tutorial · 11 min read · August 6, 2026
- SyntaxError: Unexpected Token and How to Locate It The line number in a SyntaxError is almost never the line with the mistake. And when the unexpected token is a less-than sign, your API returned an HTML error page. Tutorial · 11 min read · August 6, 2026
- Module Not Found: Fixing Cannot Resolve Errors The import works on your Windows laptop and fails on the Linux deploy box. That is not a mystery; it is your filesystem quietly ignoring capital letters. Tutorial · 11 min read · August 6, 2026
- Cannot GET /: Fixing Express Route Errors Cannot GET / is not an error at all. It is proof your server started perfectly and simply has no handler for that path, which means the fix is never in listen(). Tutorial · 11 min read · August 6, 2026
- Unhandled Promise Rejection in Node: Causes and Fixes One missing await turns a try/catch into decoration. The block completes, the promise rejects a moment later, and modern Node responds by killing your server. Tutorial · 11 min read · August 6, 2026
- Environment Variables Explained: Config Without Secrets in Code The first real security lesson most developers learn, usually the hard way — after committing an API key to a public repository. Tutorial · 10 min read · August 6, 2026
- npm vs Yarn vs pnpm: Which Package Manager to Use All three install packages. The differences are speed, disk usage and how strictly they enforce your dependency tree — and mixing them causes real problems. Comparison · 9 min read · August 6, 2026
- REST API Design: Practices That Make an API Usable An API is a user interface for developers. Most of what makes one pleasant is consistency, not cleverness. Tutorial · 11 min read · August 6, 2026
- Backend Developer Roadmap: A Practical Order to Learn In Backend is less about frameworks than about data, correctness and failure. This is the order that builds those, rather than a list of logos. Career · 12 min read · August 6, 2026
- How to Debug a 500 Internal Server Error A 500 tells you nothing except that the server failed. The logs tell you everything — and most people never look at them. Tutorial · 10 min read · August 6, 2026
- npm Errors Explained: ERESOLVE, EACCES, ENOENT and More npm errors look alarming and are mostly four recurring problems. Knowing which one you have turns a lost afternoon into a two-minute fix. Tutorial · 10 min read · August 6, 2026
- JWT Authentication Explained (and Where It Goes Wrong) A JWT is signed, not encrypted. Anyone holding one can read it — and confusing verify with decode is a complete authentication bypass. Tutorial · 11 min read · August 5, 2026
- REST vs GraphQL: An Honest Comparison GraphQL solves a real problem that most projects do not have. Knowing which problem is the difference between a good choice and cargo cult. Comparison · 10 min read · August 5, 2026
- HTTP Status Codes Explained: The Ones You Actually Meet The first digit tells you who has the problem. Getting 401 and 403 the wrong way round is the mistake almost every API makes at least once. Tutorial · 10 min read · August 5, 2026
- What Is CORS and How to Fix the Error The request worked in Postman and fails in the browser. Nothing is broken — you are meeting a rule that only browsers enforce. Tutorial · 10 min read · August 5, 2026
- JavaScript Fetch API Tutorial: Call APIs From the Browser A beginner-friendly guide to calling APIs from the browser with fetch: GET, POST, JSON, headers, error handling, and async/await, with working code. Tutorial · 9 min read · July 22, 2026
- How to Build a REST API with Node.js and Express A beginner-friendly, step-by-step tutorial: build a small REST API in Express with working GET, POST, PUT and DELETE routes you can run and test yourself. Tutorial · 9 min read · July 22, 2026
- What Is npm? Node Package Manager Explained A beginner-friendly guide to npm: what it does, how package.json and npm install work, and how to run npm scripts on your very first project. Tutorial · 9 min read · July 22, 2026
- What is an API? A Simple Explanation for Beginners An API lets two programs talk to each other. Learn what that means with a simple waiter analogy, plus REST, JSON, status codes, and a real fetch() demo. Tutorial · 9 min read · July 22, 2026
Auth, sessions and security
- RBAC vs ABAC: Two Ways to Model Permissions Roles are easy to reason about until you need "editors can only edit their own drafts." That single requirement is where RBAC ends and attribute-based rules begin. Comparison · 8 min read · September 3, 2026
- OWASP Top 10 Explained: Ten Categories, Ten Fixes Most people memorise the ten names and still ship broken access control. The list names categories of failure, not specific bugs, and that gap is where projects get hit. Tutorial · 12 min read · August 6, 2026
- SQL Injection Explained: The Fix Is Not Escaping Quotes Two dashes typed into a login box can delete the password check from your own query. The fix is not smarter escaping, and most beginners reach for escaping first. Tutorial · 12 min read · August 6, 2026
- CSRF Explained: Why Your Own Cookie Attacks You The attacker never reads a single byte of the response, and the transfer still goes through. That is the part people misjudge about CSRF. Tutorial · 12 min read · August 6, 2026
- Password Hashing Explained: Why SHA-256 Is Wrong Here SHA-256 is a good hash. That is exactly the problem: it is fast, and speed is the one property you do not want when someone is guessing your users' passwords. Tutorial · 12 min read · August 6, 2026
- Cookies vs Sessions vs Tokens: What Is the Difference? These three get compared as if they were competing options. They are not — a cookie is a delivery mechanism, and it can carry either of the other two. Comparison · 10 min read · August 5, 2026
Performance and scale
- Redis vs Memcached: Choosing a Caching Layer Memcached is a fast, simple key-value cache and nothing more. Redis is that plus data structures, persistence, pub/sub, and scripting. The extra features decide it. Comparison · 8 min read · September 5, 2026
- WebSockets vs Server-Sent Events If the server only needs to push updates down to the client, SSE is less code and survives more infrastructure. The moment the client must send messages back in real time, you want WebSockets. Comparison · 8 min read · September 3, 2026
- Caching: Making Things Fast, and the Two Hard Problems Caching is the easiest large performance win available and the source of some of the most confusing bugs in software. Both facts come from the same place: a cache is a second copy of the truth. Tutorial · 9 min read · August 21, 2026
- Go: A Small Language Built for Servers Go was designed by people annoyed with large languages and slow builds. Almost every decision in it is a deliberate refusal to add something, and that is the point. Tutorial · 8 min read · August 16, 2026
- ORM vs Raw SQL: The N+1 Problem and When to Drop Down The loop that prints student.college.name runs one query per student. It is instant on your twenty-row dev database and it times out the moment real data arrives. Comparison · 12 min read · August 6, 2026
- HTTP Caching Explained: Cache-Control, ETag and Stale Deploys Caching is the cheapest performance win available — and the cause of the bug where users keep seeing an old version of your site after you deploy. Tutorial · 10 min read · August 6, 2026
- SQL Indexes Explained: When They Help and When They Hurt An index is the biggest single win available on a slow query — and the easiest thing to add so carelessly that it makes the database worse. Tutorial · 11 min read · August 5, 2026
Shipping it
- Bash Scripting Basics: Write a Script You Can Trust rm -rf "$DIR/"* with DIR unset expands to rm -rf /* and the shell will not stop you. Here is the small set of habits that separates a script you run in production from one you run once. Tutorial · 10 min read · August 6, 2026
- Nginx Basics for Developers: Reverse Proxy Explained Adding one slash to the end of proxy_pass changes the URL your backend receives. That single character is behind most of the 404s people blame on their router. Tutorial · 10 min read · August 6, 2026
- DNS Explained: Records, TTL and the Propagation Myth DNS propagation is not a thing. Nothing propagates. Old answers simply expire, on a clock you had to set before you made the change. Tutorial · 11 min read · August 6, 2026
- Python Logging: Why print() Is Not Enough logging.info() prints nothing on a fresh interpreter and never tells you why. The root logger defaults to WARNING, so your first three log lines vanish and you conclude logging is broken. Tutorial · 11 min read · August 6, 2026
- Docker for Beginners: What It Is and When You Need It Docker solves a real problem, and it is not the problem most beginners are told it solves. Here is what it is actually for. Tutorial · 11 min read · August 6, 2026
- What Is CI/CD? A Beginner's Explanation CI/CD sounds like enterprise infrastructure. It starts as one file that runs your tests whenever you push. Tutorial · 10 min read · August 6, 2026
More on Backend & APIs
- Drizzle ORM Basics: SQL-First Type-Safe Queries Most ORMs hide SQL behind their own vocabulary. Drizzle keeps the shape of SQL and adds types on top, so what you write and what runs look almost identical. Tutorial · 8 min read · September 14, 2026
- Contract Testing Explained: Catching Breaking API Changes Early Unit tests pass, integration tests pass in isolation, yet the mobile app breaks the day you deploy. Contract testing sits in the gap between them. Tutorial · 8 min read · September 6, 2026
- Dead Letter Queues Explained: Where Failed Messages Go One malformed message can retry forever and jam an entire queue behind it. A dead letter queue is where you put it instead. Tutorial · 7 min read · September 5, 2026
- API Pagination: Cursor vs Offset OFFSET pagination looks fine in every demo and breaks the moment real data starts changing while someone is on page 2. Comparison · 8 min read · September 5, 2026
- PostgreSQL vs MySQL: Choosing a Relational Database Both are mature, free, and fast enough for almost any app. The differences that matter are in data types, JSON handling, strictness, and how far you can extend them. Comparison · 9 min read · September 5, 2026
- Distributed Tracing Explained: Following a Request Across Services A request touches five services and one of them is slow. Grepping five log files won't find it — a trace ID will. Tutorial · 8 min read · September 4, 2026
- The N+1 Query Problem, and How to Actually Fix It A page that fires 6 queries instead of 1 usually isn't a database problem — it's a loop hiding inside your ORM. Here's how to spot it and fix it correctly. Tutorial · 7 min read · August 30, 2026
- The Circuit Breaker Pattern: Failing Fast on Purpose When a downstream service is down, retrying just piles load onto something already struggling. A circuit breaker notices the failures and stops trying - fast. Tutorial · 8 min read · August 29, 2026
- The API Gateway Pattern Explained When a frontend has to call eight services to render one screen, something is wrong. An API gateway gives clients a single door - and gives you one place for auth, rate limits, and TLS. Tutorial · 8 min read · August 28, 2026
- FastAPI Basics: A Practical Introduction for Python Developers FastAPI turns ordinary Python type hints into request validation, JSON serialization, and interactive docs. Here is how the core pieces fit together - plus the async habit that quietly wrecks performance. Tutorial · 8 min read · August 23, 2026
- Flask Basics: Building Your First Python Web App Flask gives you routing and templating and then gets out of the way. Build a working app from the first route to forms and blueprints - and learn why 'working outside of application context' keeps showing up. Tutorial · 8 min read · August 23, 2026
- Django Basics: The Batteries-Included Python Framework Django hands you an ORM, an admin panel, auth, and migrations on day one. Here is how the pieces connect - and the query mistake that makes a fast framework feel slow. Tutorial · 9 min read · August 23, 2026
- Microservices vs Monolith: Why Most Projects Should Start Boring Microservices are presented as the modern way to build software and a monolith as what you migrate away from. The real trade is that microservices convert a code problem into a distributed-systems problem. Comparison · 9 min read · August 22, 2026
- Serverless: There Are Still Servers, You Just Do Not Meet Them Serverless means you never configure a machine, never patch an operating system, and pay nothing when nobody is using your code. It also means accepting constraints that make some applications a poor fit. Tutorial · 9 min read · August 17, 2026
- Message Queues: Why Your Signup Should Not Wait for the Email A signup that takes four seconds because it is waiting for a confirmation email is doing work in the wrong place. Queues are how that work moves out of the request, and they bring their own rules. Tutorial · 9 min read · August 15, 2026
- Background Jobs and Cron: Work That Should Not Happen in a Request Some work should not make a user wait, and some should happen whether anyone is using your site or not. Those are two different tools, and mixing them up causes most scheduling problems. Tutorial · 8 min read · August 14, 2026
- Elasticsearch Basics: Why LIKE '%query%' Is Not Search SQL can find rows containing a word. It cannot rank them by relevance, handle a typo, or know that 'running' and 'ran' are the same word. That gap is what a search engine fills. Tutorial · 9 min read · August 14, 2026
- Load Balancers: How One Address Serves Many Servers The moment one server is not enough, you need something in front deciding where each request goes. That decision is simple until you remember the server was storing things in memory. Tutorial · 9 min read · August 12, 2026
- MongoDB Queries for People Who Know SQL If you know SELECT and WHERE, most of MongoDB is a translation exercise. The parts that are genuinely different are worth knowing precisely, because that is where the design decisions live. Tutorial · 9 min read · August 12, 2026
- Database Transactions: ACID, Isolation and Deadlocks Two UPDATE statements in a row are not a transaction. Catching the exception does not undo the first one, and that is how money disappears from a wallet table. Tutorial · 12 min read · August 6, 2026
- MongoDB Schema Design: Embed or Reference? MongoDB will happily let one service store a pincode as a string and another store it as a number. Nothing errors. Your queries just quietly return half the results. Tutorial · 12 min read · August 6, 2026
- TCP vs UDP Explained: Reliability, Ordering and Cost TCP is reliable and UDP is not, says every textbook. The useful version is what happens on packet loss, and why TCP being a byte stream breaks more student projects than packet loss ever does. Comparison · 12 min read · August 6, 2026
- Java Streams: Where They Win and Where They Hurt A stream pipeline runs nothing until you ask it for a value, and it will refuse to run twice. Both facts explain most of the confusing bugs beginners hit. Tutorial · 11 min read · August 6, 2026
- Spread and Rest in JavaScript: Same Syntax, Opposite Jobs The same three dots do two opposite things depending on where you write them. And the copy they make is shallower than most people assume. Tutorial · 9 min read · August 5, 2026
- Frontend vs Backend vs Full Stack: Which Career Path Should You Choose? A plain, honest guide to frontend, backend, and full stack development — what each role does, who it suits, and how to choose your first path. Career · 8 min read · July 22, 2026
