Node.js and Express Backend Development

The Node.js Runtime Model: Event Loop and Non-Blocking I/O

Why Node can handle thousands of concurrent connections on one thread — and the one mistake (blocking that thread) that defeats the entire model.

CommonJS vs ES Modules, npm, and Dependency Management

Node's two module systems, why they don't mix carelessly, and what npm actually manages beyond just downloading packages.

Asynchronous Programming: Callbacks, Promises, and Async/Await

Three syntaxes for the same underlying idea — and the one mistake (an unawaited or unhandled promise) that silently swallows errors in a real server.

Express Application Structure and Routing

How Express matches an incoming request to the right handler, and setting up a real, modularly-routed Express server on your own machine.

Middleware: The Request Pipeline

Every Express request flows through a pipeline of functions, each deciding whether to pass control forward. Understanding next() is the entire mental model.

Request Parameters, Query Strings, and Bodies

Three different places data arrives from in a request, each meaning something different — mixing them up is a common source of confusing bugs.

Input Validation and Rejecting Bad Requests

Never trust a request body. Add real validation and a centralized error-handling middleware to your local Express API, so bad input is rejected consistently and safely everywhere.

REST Resource Design and HTTP Status Behavior

Designing an API's resources and status codes from the implementer's side — the same conventions this curriculum's testing courses teach testers to verify.

Structured Errors: Operational vs. Programmer Errors

Not every thrown error deserves the same response. Distinguishing an expected, handleable failure from a genuine bug changes what's safe to tell the client.

Environment Configuration and Safe Logging

Configuration belongs outside your code, not hardcoded inside it — and logs are a real, common place secrets accidentally leak.

Configuration Validation and Startup Failures

A server that starts successfully with broken configuration is worse than one that refuses to start at all — failing fast, loudly, at startup is a deliberate design choice.

Security Fundamentals and Authentication Boundaries

Baseline server-side security every API needs, and where authentication responsibility genuinely ends — without building an unsafe, from-scratch auth system.

Automated Testing for Routes and Services

Test the pieces of a real Express API the way this curriculum's testing courses teach — separating logic from routing so most of it never needs a running server at all.

Graceful Shutdown and Operational Readiness

What actually happens when a real server needs to stop — and why an abrupt, ungraceful shutdown can silently drop in-flight work that a slightly more careful one wouldn't.