Learn Backend with Node.js

What you’ll learn

1. Chapter 1Node.js: JavaScript on the server – What Node.js is, data as JSON, waiting with async/await, catching errors – the tools for every server.
   JavaScript without a browser · Data as JSON · Waiting with async and await · Catching errors with try and catch · Boss: evaluating orders
2. Chapter 2Express: the first web server – Routes and responses, path parameters, status codes and search filters – and at the end your own small API.
   Routes and responses · Path parameters with :id · Setting status codes · Searching and filtering with the query · Boss: a weather API
3. Chapter 3REST: create, read, update, delete – POST, PATCH and DELETE with the right status codes, clean REST addresses and a complete notes API.
   POST: creating data · PUT and PATCH: changing data · DELETE: deleting data · One resource, five routes · Boss: the notes API
4. Chapter 4Backend: your own server with Node.js and Express – A server answers requests: routes, parameters, search filters, receiving data and a small REST API – all live in the app.
   The first server: Express · Routes with placeholders: req.params · Searching and filtering: req.query · Receiving data: POST and express.json() · Boss: a small REST API
5. Chapter 5Validating input and clear errors – Checking required fields, types and limits, rules as a schema, consistent error responses and an event registration with 409.
   Checking required fields · Checking types and limits · One validation function for all routes · Consistent error responses · Boss: the event registration
6. Chapter 6Routers and middleware – Bundling routes with express.Router, mounting areas, middleware before the routes and a 404 handler in API format.
   express.Router: bundling routes · Several areas in one API · Registering middleware: extending req · The 404 handler at the end · Boss: an API with areas
7. Chapter 7List APIs: pages, sorting, filtering – Loading page by page, sorting without changing the data, combining filters, responses with metadata and a complete product catalogue.
   Loading page by page · Sorting via the query · Combining several filters · Responses with metadata · Boss: the product catalogue
8. Chapter 8Backend in depth: middleware, routers and protection – Code before every route, organising routes, handling errors centrally and protecting areas with a key.
   Middleware: code before every route · Organising routes: express.Router · Handling errors centrally · Protecting areas: headers and 401 · Boss: a protected notes API
9. Chapter 9An SQL database in the server – Opening a database, creating tables, inserting and reading with prepare and placeholders, sample data at startup – and a leaderboard.
   Opening a database and creating a table · Inserting with prepare and run · Reading with all and get · Sample data at the first start · Boss: a leaderboard in the database
10. Chapter 10REST API with a database – Lists, single rows, creating, updating and deleting – all routes of a REST API directly on an SQL table.
    GET: the list from the database · GET with an id: one row or 404 · POST: saving in the database · PATCH and DELETE with changes · Boss: the task API with SQL
11. Chapter 11Saving safely and cleanly – Understanding and preventing SQL injection, named placeholders, catching duplicates with UNIQUE and 409, transactions – and an order with stock levels.
    Understanding SQL injection · Placeholders with names · UNIQUE: catching duplicate entries · Transactions: all or nothing · Boss: the order with stock levels
12. Chapter 12Joining tables – Foreign keys, JOIN in the API, counting and totals with GROUP BY, nested responses – and a shop dashboard.
    Foreign keys: orders belong to customers · JOIN: data from two tables · Counting and totals with GROUP BY · Building nested responses · Boss: the shop dashboard
13. Chapter 13Accounts and passwords – Why passwords are never stored in plain text, hashing with salt, signing up and logging in – safely and with the right status codes.
    Why passwords are never in plain text · Hashing with salt · Signing up: creating an account · Logging in: checking the password · Boss: sign-up and login
14. Chapter 14Staying logged in: tokens – Issuing session tokens, reading the Authorization header, protecting routes with middleware, logging out – and a private profile.
    Issuing a session token · The Authorization header · Middleware protects routes · Logging out: invalidating the token · Boss: the private profile
15. Chapter 15Roles and signed tokens – 401 or 403, checking ownership, signing tokens with HMAC, expiry times – and an admin area like with JWTs.
    Roles: 401 or 403? · Only the owner may change it · Signed tokens with HMAC · Expiry time in the token · Boss: an admin area with signed tokens
16. Chapter 16Fending off attacks – Rate limits against brute force, defusing output against XSS, security headers, not revealing errors – and a hardened login.
    Slowing down too many attempts · Defusing HTML output (XSS) · Setting security headers · Not revealing errors · Boss: the hardened login
17. Chapter 17Logging and error handling – Logging requests, measuring response times, passing on errors in async routes, custom error classes – and error handling for the whole API.
    A logging middleware · Measuring response times · Errors in async routes · Your own error classes · Boss: error handling for the whole API
18. Chapter 18Frontend + backend: a full-stack app – Web page and server work together: loading data, showing lists, sending forms, showing errors – two files, connected live.
    The page asks its own server · Showing server data as a list · Sending a form to the backend · When the server says no: antwort.ok · Boss: a full-stack to-do app
19. Chapter 19Configuration and operation – Environment variables, secrets outside the code, a config object, a health check – and a server that is ready to deploy.
    Reading environment variables · Secrets do not belong in the code · A config object with defaults · A health check for operation · Boss: ready to deploy
20. Chapter 20Writing API tests – Checking with assert, tests with node:test, testing your own API, covering error cases – and a test suite for a whole API.
    assert: checking instead of hoping · The first test with node:test · Testing your own API · Testing error cases · Boss: a test suite for the notes API
21. Chapter 21Project: a booking API – A data model with free seats, listing showings, booking with a transaction, your own bookings with login – and the finished API with a test suite.
    The data model with free seats · Listing showings · Booking seats with a transaction · My bookings – only for logged-in users · Boss: the finished booking API

Final project: Your booking API

A REST API with an SQL database, login, protected routes, transactions and tests.

How it works

Every lesson starts with short explanation pages. Then you practise with multiple-choice questions, fill-in-the-gap tasks, putting code in order and writing your own code – with hints and instant feedback. Free, without ads, on phone, tablet and PC.

Learn Backend with Node.js now