Node.js — Full Course Syllabus

Practical, atomic skills for building stateful HTTP services in Node.js including REST/GraphQL endpoints, middleware, persistent state, and authentication patterns.

1. 1. Creating an http.Server with Node.jsInstantiate and start a basic HTTP server using Node's http.createServer and server.listen.
2. 2. req and res objects (IncomingMessage & ServerResponse)Understand the properties and methods on Node's request and response objects used to read requests and write responses.
3. 3. Parsing URL and query parameters (url and URLSearchParams)Extract pathname and query parameters from request URLs using the WHATWG URL API or url module.
4. 4. Setting response headers and status codesSend proper HTTP status codes and response headers using res.writeHead/res.setHeader and res.statusCode.
5. 5. Routing basics (path matching)Dispatch requests to handlers based on HTTP method and URL path using simple pattern matching.
6. 6. Express app and Router() instantiationCreate an Express application and use express.Router to organize route handlers.
7. 7. Route parameters and req.paramsDefine dynamic route segments and access their values via req.params.
8. 8. Query params (req.query)Access parsed query string parameters available on req.query in Express apps.
9. 9. Express route handlers (req, res, next)Write an Express route handler function and understand the next callback for control flow.
10. 10. Middleware signature and orderingUnderstand middleware function shape (req, res, next) and how execution order affects request handling.
11. 11. app.use() for mounting middlewareAttach middleware or routers to an application or path prefix using app.use().
12. 12. express.json() middlewareEnable automatic JSON request parsing with express.json() and how it populates req.body.
13. 13. Custom middleware for loggingImplement a small middleware that logs requests and response times.
14. 14. CORS handling with the cors packageEnable and configure Cross-Origin Resource Sharing using the cors middleware.
15. 15. Serving static files with express.static()Mount a directory to serve static assets using express.static middleware.
16. 16. Designing RESTful resource endpointsMap CRUD operations to HTTP methods and resource URL conventions for REST design.
17. 17. HTTP method handlers (GET, POST, PUT, PATCH, DELETE)Create route handlers for standard HTTP methods and apply semantic differences between them.
18. 18. Protecting routes with middlewareCreate middleware that verifies authentication/authorization before allowing access to handlers.
19. 19. Helmet and HTTP security headersUse helmet to set secure HTTP headers like CSP, X-Frame-Options, and X-Content-Type-Options.
20. 20. Environment configuration with dotenv and config patternsLoad environment-specific configuration securely and avoid mixing secrets into code.
21. 21. Health-check and readiness endpointsImplement lightweight endpoints that report application liveness and readiness for orchestration systems.
22. 22. Reading request body streamsConsume and assemble request body data from a readable stream for POST/PUT requests.
23. 23. Error-handling middleware in ExpressCreate middleware with four arguments (err, req, res, next) to centralize error responses.
24. 24. JSON response conventions & pagination headersStructure JSON responses and use headers/links for pagination metadata.
25. 25. HTTP status code selection best practicesChoose appropriate HTTP status codes (200, 201, 204, 400, 401, 403, 404, 409, 500) for responses.
26. 26. Designing idempotent endpointsMake certain endpoints idempotent and understand why idempotency matters for retries.
27. 27. Minimal GraphQL serverCreate a minimal GraphQL schema, resolver, and mount a GraphQL endpoint in Node.js.
28. 28. Defining GraphQL type definitionsDeclare object types, queries, and mutations in GraphQL SDL for a service schema.
29. 29. GraphQL resolversImplement resolver functions that fetch or modify data for GraphQL fields.
30. 30. Database client instantiation and lifecycleInitialize a database client (e.g., PostgreSQL or MongoDB driver) and manage its lifecycle.
31. 31. Executing simple queries/operations (CRUD)Perform basic create, read, update, and delete operations against a datastore from Node.js.
32. 32. Sessions with server-side storageImplement session creation, storage, and retrieval using express-session or similar with a persistent store.
33. 33. Stateless JWT authenticationIssue and verify JSON Web Tokens for stateless authentication and understand their trade-offs.
34. 34. Cookie handling and secure cookie flagsSet and read HTTP cookies, and apply secure attributes (HttpOnly, Secure, SameSite).
35. 35. Password hashing with bcryptHash and verify user passwords securely using bcrypt or an equivalent library.
36. 36. Role-based access control (RBAC)Enforce simple RBAC checks to authorize routes or actions based on user roles/permissions.
37. 37. Input validation and sanitizationValidate and sanitize incoming request data to prevent malformed input and injection attacks.
38. 38. Rate limiting middlewareApply request rate limiting to endpoints to mitigate abuse and DoS attempts.
39. 39. Structured logging with correlation IDsEmit structured logs with correlation IDs to trace requests across services and components.
40. 40. Error classification and custom Error typesCreate and use custom Error subclasses to represent domain vs system errors for consistent handling.
41. 41. Graceful shutdown and signal handlingHandle SIGINT/SIGTERM to close server and release resources gracefully during shutdown.
42. 42. Testing route handlers with supertestWrite integration tests that exercise HTTP endpoints using supertest or similar tooling.
43. 43. Unit testing middleware and utility functionsIsolate and unit-test middleware and pure helper functions using a test runner/mocking as needed.
44. 44. API versioning strategiesApply URI or header-based versioning approaches to evolve public APIs without breaking clients.
45. 45. OpenAPI (Swagger) documentation basicsAnnotate and publish API schemas with OpenAPI to generate docs and client stubs.
46. 46. Batching & DataLoader patternUse batching techniques or DataLoader to avoid N+1 fetch problems in resolvers.
47. 47. Using connection poolingConfigure and use database connection pools to manage concurrent access efficiently.
48. 48. OAuth 2.0 Authorization Code Flow (conceptual integration)Integrate an external OAuth provider using the authorization code flow to obtain user identity.