Backend Engineering
The language-agnostic backend playbook — HTTP & APIs, auth, databases, caching, scaling, messaging, and reliability. Everything an interviewer might throw at you.
Web & Networking Foundations
How the Web Works — Request Lifecycle
What actually happens end-to-end when a client hits a URL — DNS, TCP, TLS, HTTP, the server, the DB, and back.
HTTP Deep Dive
Methods, status codes, headers, request/response anatomy, and the HTTP/1.1 vs 2 vs 3 story — the stuff interviewers actually ask.
HTTPS & TLS
Why HTTPS exists, symmetric vs asymmetric crypto in plain words, the TLS handshake, and how certificates and CAs build a chain of trust.
TCP vs UDP & Ports
TCP's reliable ordered pipe vs UDP's fast fire-and-forget, when to use each, the 3-way handshake, and how ports and sockets fit in.
Real-Time: WebSockets, SSE & Long Polling
How to push data to clients when HTTP is request-response — short polling, long polling, SSE, and WebSockets, and when to reach for each.
API Design
REST API Design Principles
What REST actually means — resources, representations, statelessness — and how to design clean, RESTful endpoints.
API Error Handling & Status Codes
Returning the right status codes and a consistent, safe error shape — the stuff that separates a pro API from a hobby one.
API Versioning, Pagination & Filtering
How to evolve an API without breaking clients, and how to page through big result sets — offset vs cursor, and why cursor wins at scale.
Idempotency, Safe Methods & Retries
Safe vs idempotent methods in plain words, and how idempotency keys stop a retried payment from charging a customer twice.
REST vs GraphQL vs gRPC
Three ways to build an API — resources over HTTP, a flexible query layer, and fast binary RPC — and how to pick the right one.
Authentication & Security
Authentication vs Authorization
Authn is who you are, authz is what you're allowed to do — the difference, where each runs, and 401 vs 403.
Sessions vs JWT
Server-stored session cookies vs stateless signed JWTs — structure, trade-offs, the revocation problem, and where to store tokens.
OAuth 2.0 & OpenID Connect
Delegated access without sharing your password — OAuth roles, the Authorization Code flow with PKCE, tokens, and how OIDC adds identity.
Password Storage & Hashing
Why we never store plaintext, hashing vs encryption, salt and pepper, and slow adaptive hashes like bcrypt/argon2.
Top Web Vulnerabilities (OWASP)
SQL injection, XSS, CSRF, and SSRF — what each attack does, how it works, and the one-line fix for each.
Rate Limiting, CORS & Secrets Management
Rate-limit algorithms and 429s, what CORS and preflight actually do, and how to handle secrets safely.
Databases in Practice
SQL vs NoSQL — Choosing a Database
Relational vs NoSQL in plain words — the families, when to reach for each, and how they scale differently.
Indexing — How & When
Indexes explained like a book index — why they speed reads, slow writes, and how composite/covering indexes and EXPLAIN actually work.
Transactions & ACID
What a transaction is and the four ACID guarantees, explained with the classic bank-transfer example plus COMMIT and ROLLBACK.
Isolation Levels & Concurrency Anomalies
The three read anomalies, the four SQL isolation levels that prevent them, the performance trade-off, and a quick word on MVCC.
The N+1 Problem & Query Optimization
The N+1 query trap explained with a concrete example, the fixes (JOIN, eager loading, batching), and quick query-optimization wins.
Connection Pooling & Migrations
Why DB connections are expensive and how pools reuse them, plus how schema migrations work — versioned, up/down, and zero-downtime.
Caching
Why & Where We Cache
What a cache is, why we bother, and every layer between the browser and the database where caching happens.
Caching Strategies
Cache-aside, read-through, write-through, write-behind, and write-around — what each one does and when to reach for it.
Cache Invalidation & Eviction
Keeping cached copies honest with TTLs and invalidation, making room with eviction policies, and surviving the cache stampede.
CDNs & Redis in Practice
The two caches every backend engineer reaches for — CDNs at the edge and Redis in memory — and when to use which.
Scalability & Architecture
Vertical vs Horizontal Scaling
Scaling up with a bigger machine vs scaling out with more machines — the trade-offs, limits, and when each one fits.
Load Balancing
What a load balancer actually does, L4 vs L7, the common distribution algorithms, health checks, and sticky sessions.
Replication & Read Replicas
Copying a database so the primary handles writes and replicas serve reads — sync vs async, replication lag, and failover.
Sharding & Partitioning
Splitting a table into pieces, and splitting those pieces across servers — shard keys, strategies, hotspots, and cross-shard pain.
CAP Theorem & Consistency Models
Why a distributed system can't have consistency and availability during a network partition — CP vs AP, strong vs eventual, and PACELC.
Monolith vs Microservices
One deployable vs many small services — the real trade-offs, why 'start with a monolith' is good advice, and the modular monolith middle ground.
Async & Messaging
Sync vs Async Communication
Synchronous request-response vs asynchronous fire-and-forget, and the trade-offs that decide which one to reach for.
Message Queues & Producer-Consumer
The buffer between producer and consumer — acknowledgements, delivery guarantees, and dead-letter queues explained plainly.
Pub/Sub & Event-Driven Architecture
One event, many subscribers — how pub/sub differs from a queue and why services react to events instead of calling each other.
Kafka & Event Streaming Basics
Kafka as a distributed append-only log — topics, partitions, offsets, consumer groups, and why a log beats a queue for replay.
Reliability & Operations
Observability — Logs, Metrics & Traces
The three pillars — logs, metrics, and traces — and how they let us ask new questions about a running system.
Health Checks & Graceful Shutdown
Liveness vs readiness probes and how to shut a service down without dropping in-flight requests.
Timeouts, Retries & Circuit Breakers
Three resilience patterns that keep one slow dependency from taking down the whole system.
Distributed Transactions (Saga & Outbox)
Why ACID transactions can't span services, and the Saga and Outbox patterns we use instead.
Docker & Containers for Backend
What a container really is, how it differs from a VM, and how Dockerfile layers and caching work.
CI/CD & the 12-Factor App
Continuous integration vs delivery, a typical pipeline, and the 12-factor rules that matter most for backend.