Back-End Web Development

What a server does when you tap Buy: requests, responses, status codes, JSON and your first route.

1. What the back end does
2. Clients, servers, addresses and ports
3. Requests: methods, paths, headers and bodies
4. Status codes and responses
5. JSON and API documentation
6. Your first route

Project: Map the back end of an app you use every day

Values, decisions, functions, arrays, loops and objects, from zero.

1. Values and variables
2. Numbers, strings and booleans
3. Making decisions with if
4. Functions
5. Arrays
6. Loops
7. Objects
8. Reading error messages

Project: A price calculator for a café's orders

Array methods, modules, errors, and the asynchronous code every server runs on.

1. Array methods: map, filter and find
2. Destructuring and spread
3. Modules: import and export
4. Errors: throw, try and catch
5. Callbacks
6. Promises
7. async and await
8. Working with JSON

Project: A records processor that reads, cleans and summarises orders

Work in a terminal, and keep every change to your code safe and shareable.

1. The terminal and the file system
2. Running programs from the terminal
3. Why version control
4. Commits and history
5. Branches and merging
6. GitHub and pull requests
7. README files and .gitignore

Project: A documented repository with a clean history

JavaScript outside the browser, npm, files, and a server built with no framework at all.

1. What Node.js is
2. npm and package.json
3. Reading and writing files
4. Environment variables
5. The event loop
6. The built-in http module
7. Routing by method and path
8. Serving JSON

Project: A server with no framework that answers three routes

The framework most Node.js APIs use: routes, request data, middleware and errors.

1. Why Express
2. Your first Express app
3. Route parameters and query strings
4. Reading request bodies
5. Middleware
6. The order middleware runs in
7. Errors and the error handler
8. Serving files and CORS

Project: A café menu API that can create, read, update and delete

REST, validation, helpful errors, pagination and documentation that other developers love.

1. Resources and REST
2. Choosing methods and status codes
3. Validating input with Zod
4. Error responses people can act on
5. Pagination
6. Filtering, sorting and search
7. Versioning and changes
8. Documenting with OpenAPI

Project: A documented bookings API with validation and pagination

Tables, keys and SQL, on a real PostgreSQL database running in your browser.

1. Why apps need databases
2. Tables, rows and keys
3. SELECT, WHERE and ORDER BY
4. INSERT, UPDATE and DELETE
5. Joins
6. Grouping and totals
7. Designing tables: normalisation
8. Indexes and transactions

Project: A database for a learning platform, with the queries for its reports

Store your API’s data for good, safely, with queries that can’t be hijacked.

1. Connecting Node to PostgreSQL
2. Parameterised queries and SQL injection
3. Keeping database code in one place
4. Migrations
5. Transactions from code
6. Handling database errors
7. Query builders and ORMs

Project: Move the bookings API from memory to PostgreSQL

Sign-up, sign-in, sessions and password reset, built the way security teams expect.

1. Authentication and authorisation
2. Storing passwords: hashing
3. Registering and signing in
4. Sessions and cookies
5. Tokens and JWTs, and their limits
6. Signing out and expiring sessions
7. Password reset by email
8. Rate limiting and lockouts

Project: Sign-up, sign-in and password reset for the bookings API

Roles, access control and the OWASP API Security Top 10, by breaking and fixing a real API.

1. Roles and permissions
2. Broken access control
3. The OWASP API Security Top 10
4. Injection and input handling
5. Cross-site attacks: XSS and CSRF
6. Secrets and configuration
7. Security headers and dependency checks
8. Privacy and logging safely

Project: Find and fix the holes in a deliberately broken API

Types that catch mistakes before your users do, from handlers to validated input.

1. Why types
2. Types, interfaces and unions
3. Functions and generics
4. Narrowing and strict mode
5. Typing Express handlers
6. Zod schemas and inferred types
7. Moving a project to TypeScript

Project: Convert the bookings API to TypeScript

Automatic tests that prove your API works, including when things go wrong.

1. Why test
2. Unit tests with Vitest
3. Testing endpoints
4. Testing the unhappy paths
5. Testing sign-in and permissions
6. Test data and test databases
7. Test first: a taste of TDD

Project: A test suite that proves the bookings API works

Caching, jobs, email, webhooks, payments, uploads and real-time updates.

1. Caching
2. Background jobs and queues
3. Sending email
4. Webhooks
5. Taking payments safely
6. File uploads
7. Real-time with WebSockets
8. Monoliths, services and scaling

Project: Add payments and email receipts to the bookings API

Production settings, logs, monitoring, continuous integration, deploying and rollbacks.

1. Development, test and production
2. Configuration and secrets in production
3. Logs, health checks and monitoring
4. Continuous integration
5. Deploying your API
6. Backups and rollbacks
7. Where to go next

Project: Run your API in production mode, with checks and monitoring