Backend Architecture
System design choices for APIs, databases, queues, reliability, observability, security, and operations under failure.
27 articles in this section.
GitHub OAuth token rotation: how to migrate without logging everyone out
A practical GitHub OAuth token rotation guide: handle expiring access and refresh tokens, rotate safely, preserve sessions, and recover when users return with old credentials.
PostgreSQL 18.6 security update: a safe production upgrade guide
Patch PostgreSQL 18.6 safely, check GIN statistics, btree_gist and ltree indexes, and verify Node.js services after the August 2026 security release.
Designing a fraud detection event pipeline in Node.js
A practical Node.js fraud event pipeline with stable event contracts, idempotent consumers, rules, risk scores, review queues, audit logs, and replay safety.
Database restore tests: the backup step teams forget
Turn database backups into a tested recovery process with clear RPO and RTO targets, isolated restore drills, integrity checks, application tests, and evidence.
Background job idempotency: why workers repeat work in production
How to design idempotent background jobs so retries, crashes, and duplicate messages do not double-charge or double-send.
Audit logs for product apps: what should you record?
A practical audit logging guide for SaaS and backend apps: admin actions, auth events, data changes, exports, and privacy balance.
Password reset token design: small mistakes that create big risk
A practical guide to password reset tokens, expiration, single-use links, account enumeration, logging, and safe reset flows.
SameSite cookies explained: the setting that prevents many surprises
How SameSite cookie settings work, why they matter for login sessions, and where Strict, Lax, and None fit.
CORS misconceptions: why disabling it is not an API security plan
Understand what CORS actually controls, configure credentialed origins safely, debug preflights, and keep authentication and authorization as separate API boundaries.
Content Security Policy explained for normal web developers
A practical CSP guide with report-only rollout, strict policies, nonces, hashes, third-party scripts, reporting, and production checks.
API keys in frontend code: why this mistake keeps happening
Why API keys exposed in frontend bundles are not secret, what attackers can do, and safer patterns for browser apps.
Login rate limiting explained: protect the boring endpoint first
How to rate limit login endpoints, password reset flows, OTP checks, and account creation without punishing normal users.
Webhook replay attacks explained for backend developers
A simple guide to webhook replay attacks, timestamps, signatures, idempotency, and safe event processing in Node.js APIs.
Idempotency keys for APIs: how to stop duplicate payments and actions
How idempotency keys work in APIs, why retries create duplicates, and how backend developers can design safer mutation endpoints.
Object-level authorization explained: the API bug behind many leaks
A practical guide to object-level authorization, why login is not enough, and how backend developers can test cross-user access.
Next.js Server Actions security checklist for real apps
Secure Next.js Server Actions with in-action authorization, strict validation, safe return values, abuse limits, idempotency, logging, and negative tests.
GitHub Actions OIDC explained: stop storing long-lived cloud secrets
Replace long-lived deployment keys with GitHub Actions OIDC, narrow cloud trust by repository and environment, and test denial before deleting old secrets.
PostgreSQL 19 beta explained: should normal developers care yet?
A practical guide to PostgreSQL beta releases, why PostgreSQL 19 beta matters, and how teams can evaluate features safely.
PostgreSQL security update checklist for backend teams
How backend teams should respond to PostgreSQL security and bug-fix releases without breaking production databases.
OWASP API Security Top 10 explained for Node.js backend developers
Apply the OWASP API Security risks to Node.js routes with object-level authorization, schema validation, rate limits, inventory, logging, and abuse tests.
HTTP QUERY method explained: the new method between GET and POST
A practical guide to the new HTTP QUERY method, why RFC 10008 added it, how it compares with GET and POST, and when backend developers should care.
Cursor pagination vs offset pagination for APIs
A practical comparison of cursor pagination and offset pagination for backend APIs, including performance and user experience.
PostgreSQL indexes explained for backend developers
How PostgreSQL indexes speed up queries, when they hurt writes, and how backend developers should think about them.
Database transactions explained for backend developers
A practical explanation of database transactions, atomicity, rollbacks, isolation, and when backend code needs them.
Queue dead-letter pattern in Node.js: what to do with failed jobs
Design a Node.js dead-letter workflow with bounded retries, useful failure records, replay controls, idempotent workers, alerts, and safe operator recovery.
Webhook signature verification in Node.js: the part tutorials skip
Verify webhook signatures in Node.js without corrupting the raw body, avoid timing leaks, reject stale deliveries, and process valid events idempotently.
Rate limiting in Node.js with Redis: a practical guide
Build an atomic Redis rate limiter for Node.js, choose useful identities and limits, handle proxy IPs, and decide what happens when Redis is unavailable.