Backend & APIs
The server side — Node, Nest and Python, REST and GraphQL, authentication, background work, and the failure modes that only appear under concurrency.
- Node Backend FrameworksExpress and Fastify don't change the concurrency model underneath them — they change what runs on top of it. What saturates first is still the event loop, and the framework just decides how easy that is to hit by accident.
- Dependency-Injected Backend FrameworksNestJS and its relatives add a request lifecycle and a provider scope model on top of the same event loop — which means the same blocking-handler failure now hides behind a decorator, and a new failure (shared request-scoped state) becomes possible that plain Express never had.
- Python Backend Runtimes — WSGI and ASGIWSGI gets its concurrency from OS processes; ASGI gets it from an event loop borrowed straight from the same model Node uses. They fail in opposite ways, and a synchronous call in the wrong one collapses throughput exactly like a blocking Express handler does.
- REST APIsThe parts of REST that only bite you past the first CRUD endpoint — caching headers, content negotiation, versioning, and the hypermedia question everyone skips.
- Graph Query APIsGraphQL solves over-fetching by letting the client shape the query — which means the client now also shapes the cost, and an unbounded query is an unbounded bill.
- Validation and SerializationThe server is the trust boundary, not the browser — schema validation and serialization are where an attacker-controlled string either becomes a typed value or reaches your database as-is.
- Realtime APIsWebSockets and Server-Sent Events remove polling and hand you reconnection, backpressure, and fan-out instead — and the question that actually matters is what happens to a message sent while the client was gone.
- Authentication & AuthorizationTwo different questions bolted together in most codebases — who you are and what you can do — and what revoking access actually costs under a session, a JWT, and OAuth.
- API SecurityDefensive coverage of the vulnerabilities that actually show up in backend APIs — every recommendation stated as a threat, a mitigation, and a way to verify it holds.
- Background JobsWhat moves work out of the request path — scheduling, idempotent execution, and catching the job that fails silently instead of loudly.