How to build · 04

Backend Development

Node.js, Express, NestJS, Java and Spring Boot, Python, FastAPI and Django, authentication, permissions, jobs.

Read: 0 / 13Backend Fundamentals Node.js Express NestJS Java Spring Boot FastAPI Django Authentication Authorization Background Jobs Backend Testing Backend Architecture

Backend Fundamentals

Fundamentals✓
What backend is: server, API, database and everything in between
The backend is the server side of an application: code that receives HTTP requests, checks data and permissions, applies business rules, talks to the database and external services, and returns a response. Users cannot see or change it, so everything that money, access and data integrity depend on is decided here. A minimal backend is a process with an API, a database, configuration in environment variables and logs; as it grows, it gains a cache, queues and background workers.
Beginner · 10 min read

Node.js

Tutorial✓
Node.js from scratch: modules, npm and a first server
Node.js is a JavaScript runtime outside the browser: the same language, but instead of the DOM and window you get the file system, the network and operating system processes. A Node.js project starts with npm init and a package.json file, where ES modules are enabled with "type": "module". A first server is written on the built-in node:http module with no dependencies, settings come from environment variables via the --env-file flag, and --watch restarts the process when the code changes.
Beginner · 9 min read · practice ~45–90 min

Express

Tutorial✓
REST API on Express: CRUD, validation, errors
A REST API on Express is built from three parts: routes for each action on a resource (GET, POST, PATCH, DELETE on /api/tasks), middleware that parses JSON and logs requests, and a central error handler with four arguments. Input is checked with a Zod schema, and every error — an invalid field, a missing record, a conflict — becomes a response with the right code (400, 404, 409) in a single Problem Details format. In Express 5, errors from async handlers reach that handler automatically.
Beginner · 9 min read · practice ~1.5–3 h

NestJS

Tutorial✓
NestJS: modules, controllers, services and DTOs
NestJS is a Node.js framework that adds structure on top of Express: code is split into modules, controllers handle HTTP, logic lives in service providers, and a built-in dependency injection container wires them together. Input is described with DTO classes decorated with class-validator rules and checked by ValidationPipe before the handler runs. To test a whole module, Nest boots the application inside a test with @nestjs/testing, and supertest sends the requests.
Intermediate · 11 min read · practice ~1.5–3 h

Java

Tutorial✓
Java for backend: syntax, types, collections and Maven
Backend Java needs a small but dense core: static types and var, classes and record for data, the List, Set and Map collections, the Stream API to process them, Optional instead of null, and a clear grasp of checked and unchecked exceptions. Maven builds the project: pom.xml declares the Java version and dependencies, and mvn package compiles the code, runs JUnit tests and packages a jar. The current LTS release is Java 25.
Beginner · 10 min read · practice ~1.5–3 h

Spring Boot

Tutorial✓
Spring Boot: a REST API from scratch
A Spring Boot REST API has three layers: a @RestController accepts HTTP requests and returns JSON, a @Service holds rules and transactions, and a Spring Data JPA repository interface talks to the database without hand-written SQL. Input is described by DTOs with Jakarta Bean Validation annotations and @Valid, and 400 and 404 errors are returned in RFC 9457 format via @RestControllerAdvice. You generate the project on start.spring.io, verify it with MockMvc tests on H2, and run it against PostgreSQL through a profile.
Intermediate · 8 min read · practice ~3–6 h

FastAPI

Tutorial✓
FastAPI: a Python API with validation and documentation
FastAPI is a Python framework for HTTP APIs in which parameter types and Pydantic models act as input validation, output filtering and API description at the same time: they produce the OpenAPI schema and the interactive docs at /docs. A route is a plain function decorated with @app.get or @app.post. Shared logic such as storage access or an API key check is plugged in with Depends, and tests are ordinary pytest functions using TestClient. This lesson builds a leads API with seven tests, verified on FastAPI 0.143 and Pydantic 2.14.
Beginner · 11 min read · practice ~1.5–3 h

Django

Tutorial✓
Django: models, admin and views
Django is a Python framework that ships with an ORM, database migrations, an admin panel, CSRF-protected forms, templates and a test runner. You describe a model as a Python class, makemigrations and migrate turn it into a table, and a single @admin.register line gives you a working interface for editing the data. This lesson builds a service catalogue with a public page, an inquiry form, a JSON view and seven tests on Django 6.1.
Beginner · 10 min read · practice ~1.5–3 h

Authentication

Deep dive✓
Authentication: sessions, cookies and JWT
For a website with its own backend, a server-side session is the most reliable option: after the password check the server creates a record, and the browser gets a random identifier in a cookie with HttpOnly, Secure and SameSite. JWT fits when other services or a mobile client verify the token, but it is hard to revoke before it expires, so it lives for minutes and logout needs refresh tokens or a revocation list. Tokens do not belong in localStorage, and cookie-based requests need CSRF protection.
Intermediate · 14 min read

Authorization

How-to✓
Authorization: roles, permissions and server-side access checks
Authorization decides what a user may do, and it is enforced only on the server — on every request. Permissions are easiest to describe as a “role → allowed actions” matrix checked in route middleware, while access to a specific record is checked separately by limiting the data query itself to records the user may see. Without login the server answers 401, without permission for the action 403, and another user’s record is best returned as 404 so its existence isn’t confirmed.
Intermediate · 8 min read · practice ~1–2 h

Background Jobs

How-to✓
Background jobs and queues: what to move out of the request
Move out of the HTTP request anything that is slow, depends on third-party services and is not needed for the response: emails and notifications, CRM calls and outgoing webhooks, reports and exports. The API puts a job on a queue and replies right away, while a separate worker process runs it and, on failure, retries with growing pauses. To keep a retry from sending a second message, make the handler idempotent, and collect jobs that ran out of attempts for separate review.
Intermediate · 10 min read · practice ~1–2 h

Backend Testing

Tutorial✓
Backend testing: unit and integration tests for an API
A backend is tested at two levels. Unit tests run the service's business logic in memory: the database and external APIs are replaced with stand-ins, and such tests finish in a fraction of a second. Integration tests send real HTTP requests to the app through supertest and talk to a real PostgreSQL in Docker; that's the only way to check SQL, database constraints, status codes and access rules. In both cases external services are mocked, and every test starts with a clean database.
Intermediate · 8 min read · practice ~1.5–3 h

Backend Architecture

Fundamentals✓
Backend application layers: controller, service, repository
Backend code is split into three layers: the controller turns an HTTP request into a call and the result back into an HTTP response, the service applies business rules and controls transactions, and the repository reads and writes data. Input shape validation lives in the controller, domain rules in the service, and SQL only in the repository. This split lets you test rules without HTTP or a database by passing an in-memory repository, and change storage without touching the logic.
Intermediate · 10 min read

Learning paths with this direction

Java · 6 →Spring Boot · 7 →Backend with Node.js · 8 →← All directions

Tell us about your task — we'll review your request and get back to you

Got a project?
We'll scope and estimate it — for free.

Tell us about the product or the problem. After reviewing the task we'll come back with an architecture, a timeline and a price for the first version.

Scope and risks estimated before we start
NDA — yours or ours
Work starts within a week

Message on WhatsApp