MERN Course: Node.js & Express

Introduction

Node.js and Express complete the MERN back-end. This final syllabus section covers production API patterns, security, package publishing, and how to present your work.

Course Reference

Quick index

Week 22: Node.js & Express Foundations

1. Unleashing the Power of Node.js

Node.js runs JavaScript on the server with a non-blocking event loop. npm manages packages; CommonJS (require) and ESM (import) both exist — prefer ESM in new projects.

Example:

import fs from 'node:fs/promises'
 
const data = await fs.readFile('./posts.json', 'utf8')
console.log(JSON.parse(data).length, 'posts loaded')

Back to index

2. Asynchronous Programming in Node.js

Concurrent I/O with async/await keeps APIs responsive. Use Promise.allSettled when partial failures are acceptable.

Example:

const [users, posts] = await Promise.all([
  fetch('https://api.example.com/users').then((r) => r.json()),
  fetch('https://api.example.com/posts').then((r) => r.json()),
])

Back to index

3. Building Your First Express Application

Express is minimal routing + middleware. Middleware runs in order — auth, parsers, routes, error handler last.

Example:

import express from 'express'
 
const app = express()
app.use(express.json())
 
app.get('/api/health', (_req, res) => {
  res.json({ status: 'ok' })
})
 
app.listen(3001, () => console.log('API on :3001'))

Back to index

Week 23: RESTful APIs & Database Integration

4. Designing and Building a RESTful API

Resources are nouns (/posts), HTTP verbs express actions. Return correct status: 200 OK, 201 Created, 204 No Content, 400 Bad Request, 404 Not Found.

Example:

app.get('/api/posts', async (_req, res, next) => {
  try {
    const posts = await Post.find().sort({ createdAt: -1 }).limit(20).lean()
    res.json(posts)
  } catch (err) {
    next(err)
  }
})
 
app.post('/api/posts', async (req, res, next) => {
  try {
    const post = await Post.create(req.body)
    res.status(201).json(post)
  } catch (err) {
    next(err)
  }
})

Back to index

5. MongoDB + Mongoose with Express

Connect once at startup; reuse the connection pool. Disconnect gracefully on SIGTERM in container deployments.

Example:

import mongoose from 'mongoose'
 
await mongoose.connect(process.env.MONGODB_URI)
 
mongoose.connection.on('error', (err) => {
  console.error('MongoDB error:', err)
})

Back to index

6. Authentication with JWT

Register hashes passwords with bcrypt. Login returns JWT; protected routes verify Authorization: Bearer <token>.

Example:

import jwt from 'jsonwebtoken'
import bcrypt from 'bcryptjs'
 
const hash = await bcrypt.hash(password, 12)
const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET, { expiresIn: '7d' })
 
function auth(req, res, next) {
  const header = req.headers.authorization
  if (!header?.startsWith('Bearer ')) return res.status(401).json({ error: 'Unauthorized' })
  try {
    req.user = jwt.verify(header.slice(7), process.env.JWT_SECRET)
    next()
  } catch {
    res.status(401).json({ error: 'Invalid token' })
  }
}

Back to index

Week 24: Security, Errors & Real-World API

7. API Security Best Practices

Validate and sanitize all input. Rate-limit auth routes. Helmet sets security headers; CORS restricts browser origins.

Example:

import helmet from 'helmet'
import rateLimit from 'express-rate-limit'
 
app.use(helmet())
app.use('/api/auth', rateLimit({ windowMs: 15 * 60 * 1000, max: 20 }))

Back to index

8. Error Handling and Debugging

Structured logging (pino, winston) beats console.log in production. Include request ID for tracing.

Example:

app.use((err, _req, res, _next) => {
  console.error(err)
  const status = err.status ?? 500
  res.status(status).json({
    error: status === 500 ? 'Internal server error' : err.message,
  })
})

Back to index

9. Project: Building a Real-World API

Capstone API: e-commerce, social, or booking system with auth, MongoDB, validation (Zod), tests, and OpenAPI docs.

• OpenAPI/Swagger docs for frontend team
• Integration tests with supertest + test DB
• Docker Compose for local Mongo + API

Back to index

Week 25: Node.js Package Development

10. Node.js Package Ecosystem

npm hosts reusable modules. Study popular packages (express, zod, date-fns) for API design inspiration.

Back to index

11. Creating Your First npm Package

Structure: src/index.js, package.json with main/exports, README, MIT license. Publish with npm publish --access public.

Example:

{
  "name": "@yourscope/mern-utils",
  "version": "1.0.0",
  "type": "module",
  "exports": "./src/index.js",
  "files": ["src"]
}

Back to index

12. Testing and Maintaining Packages

Unit test public API surface. CI runs tests on every push. Changelog documents breaking changes.

Example:

// vitest or jest
import { slugify } from '../src/index.js'
test('slugify', () => {
  expect(slugify('Hello World')).toBe('hello-world')
})

Back to index

Week 26: Final Project & Career Paths

13. Final Package Project

Publish a utility package: slug generator, env validator, or Express middleware. Document with examples and TypeScript types.

Back to index

14. Node.js & Express Mastery Recap

Core review: event loop, modules, async patterns, middleware pipeline, security, testing, deployment.

• Event loop — non-blocking I/O, avoid sync crypto on hot paths
• Middleware order matters — parsers before routes, errors last
• 12-factor app: config in env, logs to stdout, stateless processes

Back to index

15. MERN Career Paths & Portfolio

Roles: front-end, back-end, full-stack, DevOps. Showcase MERN projects on GitHub, write blog posts (like this series), contribute open source.

• Portfolio: 2–3 deployed apps with README and live demos
• Blog: explain what you built and tradeoffs you made
• Network: local meetups, Twitter/X, LinkedIn, conference CFPs

Back to index