Mostly backend, systems, and things I misunderstood at first.
This is a collection of notes I write while learning backend systems. Written for clarity, not completeness.
Recent Posts
Build SocialPulse, a production-ready social media REST API from scratch. This capstone challenge pushes you to implement secure JWT auth with refresh tokens, Cloudinary avatar uploads, full post CRUD with pagination and sorting, Zod validation, global error handling, and rate limiting, all using practical, real-world backend patterns.
Stop storing files on your server! In this guide, we upgrade our Node.js upload pipeline from local disk storage to a scalable cloud architecture using Cloudinary. Learn how to handle file streams in memory, manage persistent user avatars, and clean up orphaned files automatically.
If Auth is the bouncer at the front door, file uploads are the heavy cargo at the back dock. In this guide, we implement a secure "Loading Dock" for your Node.js API using Multer. Learn how to receive, validate, and store user files safely without letting malicious ingredients clog up your kitchen.
Your users shouldn't have to log in every 15 minutes. Learn how to implement Refresh Tokens with HTTP-only cookies to keep users securely logged in for days, with automatic token renewal, multi-device session management, and built-in revocation for when things go wrong.
Learn how to build a complete JWT-based authentication system from scratch. In Part 2 of our Authentication Series, we implement a secure login flow, generate JSON Web Tokens for user sessions, and protect API routes with authentication middleware. By the end, you'll have a production-ready auth system that verifies user credentials and issues cryptographically signed tokens—turning your API from an open door into a properly guarded fortress.
Security doesn't begin when someone logs in—it begins the moment you store their password. In Part 1 of our Authentication Series, learn the golden rule of password security: never store plain text. We'll build secure user registration with bcrypt hashing, Mongoose pre-save hooks, and production-ready validation, ensuring that even if hackers steal your database, your users' passwords remain safe.