backend-dev

Backend Development

Core Principles

• Stateless services — don't store session state in memory; use Redis or a DB
• Fail fast — validate inputs at the boundary, return errors early
• Idempotency — POST/PUT endpoints that can be called multiple times safely
• Observability — every service needs logs, metrics, and traces

---

API Endpoint Structure

Request Lifecycle

Request → Rate Limiting → Authentication → Authorization → Validation → Business Logic → Response

Never skip this order. Auth before business logic. Validation before processing.

Response Standards

// Success
{ "data": { ... }, "meta": { "page": 1, "total": 100 } }

// Error
{ 
  "error": { 
    "code": "VALIDATION_ERROR",
    "message": "Human-readable description",
    "details": [{ "field": "email", "issue": "Invalid format" }]
  }
}

---

Authentication Patterns

JWT Best Practices

• Short access token TTL (15 min) + long refresh token (7 days)
• Store refresh token in httpOnly cookie (not localStorage)
• Validate signature, expiry, issuer, and audience
• Rotate refresh tokens on use
• Maintain a revocation list or use short-lived tokens only

Session-Based Auth

• Store session ID in httpOnly, Secure, SameSite cookie
• Store session data in Redis with TTL
• Regenerate session ID after login (session fixation prevention)

Authorization

// Check authorization at the service layer, not just the route
async function getOrder(userId: string, orderId: string) {
  const order = await db.orders.findById(orderId)
  if (!order) throw new NotFoundError()
  // Authorization check — user can only see their own orders
  if (order.userId !== userId) throw new ForbiddenError()
  return order
}

---

Background Jobs & Queues

Use queues for:

• Email sending
• Image/file processing
• External API calls that don't need to be synchronous
• Long-running tasks

Job Patterns

Fire-and-forget: Enqueue and return immediately
Scheduled: Run at specific time (cron)
Delayed: Run after X minutes/hours
Retry: Re-attempt on failure with backoff