Backend Engineering Course

Lesson 1 • Development Environment Setup

Configures a local environment with a runtime, package manager, and version control. Ensures every learner has a consistent baseline before writing code.

Lesson 2 • Core Programming Concepts for Backends

Reviews variables, control flow, functions, and modules as applied to server-side code. Bridges general programming knowledge to backend-specific patterns.

Lesson 3 • How the Web Works

Covers HTTP request-response cycles, DNS resolution, and TCP/IP basics. Establishes the communication layer all backend code operates within.

Lesson 1 • Routing and Controller Structure

Implements route definitions, parameter parsing, and controller separation. Establishes clean code organization that scales as the API grows.

Lesson 2 • Error Handling and Status Codes

Builds a centralised error-handling layer that returns meaningful HTTP status codes. Connects validation, business, and infrastructure errors to appropriate responses.

Lesson 3 • API Documentation and Contracts

Generates and maintains machine-readable API documentation alongside code. Enables frontend teams and external consumers to integrate reliably.

Lesson 4 • Request Validation and Serialization

Validates incoming payloads and serialises outgoing responses to consistent shapes. Prevents bad data from reaching business logic or the database.

Lesson 1 • Core SQL Queries

Teaches SELECT, INSERT, UPDATE, and DELETE with filtering, sorting, and aggregation. Builds the query vocabulary needed for all backend data access.

Lesson 2 • Schema Migrations and Version Control

Manages schema changes through versioned migration files applied in order. Ensures database state stays synchronised with application code across environments.

Lesson 3 • Joins and Relationships

Explains INNER, LEFT, RIGHT, and FULL joins to combine related tables. Enables retrieval of complex domain objects from normalised schemas.

Lesson 4 • Indexes and Query Performance

Introduces B-tree indexes, query plans, and slow-query analysis. Connects schema design decisions to measurable read and write performance.

Lesson 1 • Role-Based Access Control

Assigns roles and permissions to users and enforces them at the route level. Enables fine-grained resource protection without hardcoding user identities.

Lesson 2 • Authentication Fundamentals

Distinguishes authentication from authorisation and surveys common credential flows. Provides the conceptual grounding before implementing any auth mechanism.

Lesson 3 • Session-Based Authentication

Implements server-side sessions stored in memory or a cache with secure cookies. Demonstrates stateful auth suitable for traditional web applications.

Lesson 4 • OAuth 2.0 and Third-Party Identity

Integrates external identity providers using the OAuth 2.0 authorisation code flow. Allows users to authenticate via trusted third parties without sharing passwords.

Lesson 1 • Input Validation and Injection Defence

Prevents SQL, command, and template injection through parameterised queries and strict validation. Eliminates the most common class of critical backend vulnerabilities.

Lesson 2 • Transport Security and Secrets Management

Enforces TLS, HSTS, and secure secret storage to protect data in transit and at rest. Removes hardcoded credentials and insecure transport from the codebase.

Lesson 3 • Rate Limiting and Abuse Prevention

Implements token-bucket and sliding-window rate limiters at the API gateway and application layers. Protects endpoints from credential stuffing, scraping, and denial-of-service.

Lesson 4 • Security Testing and Auditing

Runs automated vulnerability scans, dependency audits, and penetration test scenarios. Embeds security validation into the development and deployment workflow.

Lesson 1 • Working with Document Databases

Performs CRUD operations, indexing, and aggregation pipelines in a document store. Applies schema-flexible storage to hierarchical and polymorphic data.

Lesson 2 • Object and File Storage

Stores and retrieves binary assets using object storage APIs with presigned URLs. Separates large binary data from transactional databases for cost and performance.

Lesson 3 • Choosing the Right Storage Layer

Applies a decision framework to match storage technology to workload characteristics. Synthesises all persistence options covered in the chapter into actionable guidance.

Lesson 4 • In-Memory Caching Strategies

Implements cache-aside, write-through, and write-behind patterns using an in-memory store. Reduces database load and improves response latency for hot data.

Lesson 1 • Event-Driven Service Communication

Publishes and consumes domain events to coordinate loosely coupled services. Enables services to react to state changes without direct API calls.

Lesson 2 • Message Queues and Brokers

Introduces producer-consumer queues, topics, and broker durability guarantees. Provides the infrastructure foundation for reliable async task delivery.

Lesson 3 • Background Job Workers

Implements worker processes that consume jobs, retry on failure, and report status. Connects queue infrastructure to real application tasks like emails and reports.

Lesson 4 • Synchronous vs. Asynchronous Patterns

Contrasts blocking request-response with deferred processing and event emission. Establishes when async patterns improve throughput, resilience, and user experience.

Lesson 1 • Structured Logging and Distributed Tracing

Emits structured logs with correlation IDs and propagates trace context across services. Enables root-cause analysis of failures in distributed request flows.

Lesson 2 • Database Scaling Techniques

Applies read replicas, connection pooling, and sharding to relieve database bottlenecks. Extends the SQL and NoSQL knowledge from earlier chapters to high-traffic scenarios.

Lesson 3 • Scalability Fundamentals

Defines vertical vs. horizontal scaling, stateless service design, and shared-nothing architecture. Establishes the principles that make all subsequent scaling techniques possible.

Lesson 4 • Metrics, Alerting, and SLOs

Instruments services with RED metrics, defines service-level objectives, and configures alerts. Translates raw telemetry into actionable reliability targets and on-call signals.