Free course · 11 lessons · Beginner
Node.js Backend Fundamentals with Express
Build backend APIs with Node.js 24 and Express 5: routes and routers, path and query parameters, middleware, validation with Zod, central error handling, a database, JWT authentication, testing with node:test, security headers, CORS and rate limits, and production concerns like configuration, logging and graceful shutdown. Every example starts a real Express app and shows the requests and responses.
1. Build an API with Express
Routes, parameters, middleware, validation and error handling in Express 5, with every request and response shown.
- Your First Express API — Create an Express 5 app with JSON routes, start it, and call it, seeing exactly what the server sends back.
- Routers, Path Parameters and Query Strings — Organise routes with express.Router, read path and query parameters, and return proper 404s for unknown routes.
- Middleware: Logging, Timing and Request IDs — Write middleware that runs before and after handlers, understand next() and ordering, and add request IDs and timing.
- Validating Request Bodies with Zod — Validate and coerce incoming JSON with Zod schemas, return useful 400 errors, and never trust req.body.
- Central Error Handling — Handle every error in one place: Express 5 async errors, custom HTTP errors, safe messages in production and logging.
2. Data, Auth, Tests and Production
Persist data, authenticate users with JWTs, test the API, harden it with security middleware, and run it safely in production.
- Persisting Data with SQLite and Parameterised Queries — Store data with Node's built-in SQLite module, use parameterised queries, and keep SQL out of route handlers.
- Authentication with Hashed Passwords and JWTs — Hash passwords with scrypt, issue short-lived JSON Web Tokens with jose, and protect routes with an auth middleware.
- Testing an Express API with node:test — Test routes end to end with Node's built-in test runner: start the app on a free port, send requests, assert responses.
- Security Headers, CORS and Rate Limiting — Add helmet for security headers, configure CORS for the browsers you trust, and rate-limit sensitive endpoints.
- Configuration, Logging and Graceful Shutdown — Read configuration from the environment, log structured JSON, expose health checks, and shut down without dropping requests.
3. Capstone
Design and build a complete API.
- Capstone: A Bookings API for a Small Business — Plan and build a production-ready Express API for appointments: data model, validation, auth, errors, tests and deployment.