⚙️Backend Developer

Design resource-oriented URLs with nouns such as GET /users/123, use HTTP verbs correctly, return proper status codes (200, 201, 204, 400, 401, 404, 429, 500), and version via /v1. Keep responses consistent with pagination, filtering and sorting, support idempotency for unsafe retries, and document with OpenAPI. Secure with auth, rate limiting and validation, and never expose internal errors to clients.

An idempotent operation produces the same server-side effect when retried. GET, PUT and DELETE should be idempotent while POST generally is not. For payment-style POSTs, accept an Idempotency-Key header, store its result, and return the stored response on replay. This makes retries over unreliable networks safe.

Design versioned URLs like /v1 with long deprecation windows, changelogs and sunset headers so clients can migrate safely. Prefer additive non-breaking changes within a version and reserve removal or semantic changes for new versions. Support at least two versions concurrently and communicate timelines plus migration guides clearly.

REST: resource-oriented endpoints with fixed shapes, HTTP verbs and status codes, plus strong HTTP caching and simple tooling, at the cost of over-fetching or multiple round trips. GraphQL: a single typed endpoint where clients request exactly the fields they need with rich introspection, at the cost of complex caching, query-cost control and server complexity.

Status codes group by first digit: 2xx means success like 200 and 201, 3xx means redirection like 301 and 304, 4xx means client error like 400, 401, 403, 404 and 429, and 5xx means server error like 500 and 503. Return the most specific code plus a stable machine-readable error body. Keep 5xx for true server faults so alerts stay meaningful.

Verify signatures, persist the event id with a unique constraint, and return success for duplicates without reprocessing. Process asynchronously with retries and dead-letter queues, respond quickly with 2xx only after durable receipt, and expose replay plus reconciliation jobs. Document ordering guarantees and at-least-once semantics for consumers.

Offset pagination: uses LIMIT plus OFFSET for simple page jumps but slows on deep pages and skips or repeats rows when data shifts. Cursor pagination: uses an opaque stable cursor like created-at plus id for consistent forward traversal and steady performance on large tables, at the cost of no random page jumps.

gRPC is a contract-first RPC framework over HTTP/2 with Protocol Buffers, streaming and code generation for fast polyglot service calls. Use it for internal microservices needing strict schemas, low latency and bidirectional streams. Keep REST or GraphQL at the edge for browsers and third parties where tooling and readability matter more.

Write machine-readable OpenAPI specs with request, response, error and auth examples, generate interactive docs and SDKs, and lint for breaking changes in CI. Include pagination, rate limits, idempotency keys and versioning notes with runnable samples. Treat docs as code reviewed alongside the implementation.

Return consistent problem-style bodies with machine-readable codes, human messages, trace ids and links to docs across all endpoints. Map validation to 400, auth to 401 and 403, missing resources to 404, conflicts to 409 and overload to 429 or 503 with Retry-After. Never leak stack traces and log full context server side by trace id.

Define per-plan quotas for requests, concurrency and payload size with headers showing limit, remaining and reset plus 429 responses on breach. Enforce at the gateway with Redis counters, allow burst with token buckets, and offer upgrades, batch endpoints and webhooks to reduce polling. Review top consumers and abuse patterns monthly.

Sign every payload, include event ids and timestamps, retry with exponential backoff and jitter, and document ordering plus at-least-once delivery. Provide idempotent handlers, endpoint health dashboards, failure alerts and manual replay. Version payloads additively and test with sandbox deliveries before launch.

PUT: replaces the full resource representation and is idempotent, requiring the complete object. PATCH: applies a partial update with only changed fields, which may or may not be idempotent depending on the patch format, making it efficient for large resources.

Expose field allowlists, operators, sort and cursor pagination with max page sizes and sane defaults. Translate filters to indexed queries, validate ranges to protect the database, and return facets plus total hints without expensive counts where possible. Document query cost and offer saved searches for heavy patterns.

An API gateway fronts services with routing, auth, rate limiting, validation, caching and request shaping behind one endpoint. It simplifies clients, centralizes cross-cutting policy and enables versioning plus canary releases. Avoid turning it into business logic or a single point of failure by keeping it stateless, scaled and observable.

Add fields and endpoints without removing or renaming, keep default behaviors stable, and gate breaking semantics behind versions or opt-in headers. Publish changelogs, run contract and consumer-driven tests, and monitor old-version usage before sunset. Deprecate with long windows plus migration tooling.

HATEOAS embeds links and allowed actions in responses so clients discover workflows without hardcoding URLs. It helps long-lived or stateful APIs evolve safely with self-describing transitions. Most public APIs use lighter link conventions because full hypermedia clients add complexity.

Validate shape, types, ranges and enums against versioned schemas with libraries like JSON Schema or Zod, rejecting unknown fields where strictness matters. Return field-level errors with paths, enforce size limits, and sanitize strings before storage or rendering. Share schemas between server and clients to prevent drift.

Layer contract, unit, integration and end-to-end tests with isolated databases, factories and mocked externals plus pact-style consumer checks. Cover auth, validation, pagination, idempotency and failure paths, run load tests for SLOs, and enforce coverage plus linting in CI. Seed realistic data and test migrations both ways.

An index is a sorted auxiliary structure, typically a B-tree, that lets the database find rows without scanning the whole table. Add indexes on columns used in WHERE, JOIN and ORDER BY for selective queries. The trade-off is slower writes, extra storage and planner overhead, so avoid over-indexing low-selectivity or write-heavy columns. Use EXPLAIN to confirm the index is actually used.

INNER JOIN returns only rows matching on both sides. LEFT JOIN keeps all left rows with NULLs for missing right matches, RIGHT JOIN mirrors it, and FULL OUTER JOIN keeps everything from both sides. CROSS JOIN produces the cartesian product. Sketch Venn-style diagrams and give examples like listing all users with their optional orders via LEFT JOIN.

Replication copies data to multiple nodes for read scaling, fault tolerance and geographic locality. Common patterns are single-leader with read replicas and multi-leader for multi-region writes, with synchronous versus asynchronous replication trading durability for latency. Mention failover promotion, replication lag monitoring and split-brain avoidance.

The N plus 1 problem happens when code issues one query for a list plus one extra query per item, exploding database round trips. Fix it with eager loading, JOIN fetches, batch loaders like DataLoader, or selecting related rows in one query. Confirm with query logging and counts in tests so regressions are caught early.

Sharding splits rows across multiple databases by a shard key such as tenant id or user id so writes and storage scale horizontally. Choose a high-cardinality even key, plan for rebalancing, cross-shard queries and distributed transactions, and prefer read replicas or bigger instances first. Shard only when single-node vertical scaling and replicas can no longer meet growth.

Start with EXPLAIN ANALYZE to find sequential scans, bad join order or misestimated rows, then add selective indexes, rewrite OR conditions and functions on indexed columns, and reduce retrieved columns and rows with pagination. Update statistics, fix parameter sniffing with plan hints where supported, and denormalize or cache only after measuring. Re-test under production-like data volumes.

Atomicity guarantees all-or-nothing transactions, consistency moves data between valid states, isolation hides concurrent effects per the chosen level, and durability survives crashes via write-ahead logs. Tune isolation from read committed to serializable based on anomaly tolerance and contention. Use ACID for money and inventory paths and relax only where business rules allow.

CAP states a distributed store can fully guarantee only two of consistency, availability and partition tolerance during a network split. Since partitions are unavoidable, the real choice is consistency versus availability under failure. Pick CP systems for money and inventory and AP systems for feeds and carts, then tune with quorum, retries and reconciliation.

Pooling reuses a bounded set of database connections instead of opening one per request, cutting handshake, memory and file-descriptor overhead. Size pools from latency and concurrency targets, set timeouts and max lifetime, and separate read and write pools. Monitor wait queues and tune pool plus application concurrency together.

Strong consistency: reads always reflect the latest committed write, simplifying logic at the cost of higher latency and reduced availability during partitions. Eventual consistency: replicas converge over time, giving low latency and high availability while readers may briefly see stale data, requiring versioning and reconciliation.

Isolation levels trade correctness for concurrency: read uncommitted allows dirty reads, read committed prevents them, repeatable read prevents non-repeatable reads, and serializable prevents phantoms at the highest cost. Match the level to money, reporting or analytics needs and keep transactions short with indexed access. Detect deadlocks with timeouts and retry logic.

Normalization: splits data into related tables to remove duplication and protect integrity, favoring writes and consistency with JOIN costs on reads. Denormalization: duplicates or pre-joins data for fast reads and simpler queries, favoring read speed at the cost of storage and update complexity plus sync logic.

Limit indexes to high-value access paths because every extra index slows inserts, updates and deletes plus bloats storage. Prefer composite indexes ordered by equality then range and sort columns, use partial indexes for hot subsets, and drop unused ones found by statistics. Batch writes, defer secondary index builds and vacuum regularly.

Redis serves as an in-memory store for caches, sessions, leaderboards with sorted sets, rate-limit counters, pub-sub and job queues plus lightweight streams. Use persistence and replication for durability needs, set TTLs and eviction policies, and shard with Cluster for scale. Keep it for hot, small and fast data and a database for source of truth.

Optimistic locking: assumes no conflict, checks a version or timestamp on write and retries on mismatch, which suits low-contention reads. Pessimistic locking: acquires row or table locks before writing, which suits high-contention updates but risks blocking and deadlocks, so keep lock scope and duration minimal.

Schedule full plus incremental backups with offsite encrypted copies, define RPO and RTO, and test restores regularly with timed game days. Enable point-in-time recovery, verify checksums, and document runbooks for failover and partial restores. Monitor backup age and failure alerts as high-severity incidents.

Relational databases: enforce schemas with tables, JOINs and ACID transactions, excelling at structured data and complex queries with strong consistency. Document databases: store flexible JSON-like documents with easy horizontal scale and fast key or index access, excelling at evolving shapes and high throughput with typically looser transactions.

Detect with engine deadlock graphs, lock-wait monitoring and timeouts, then retry victims with backoff. Prevent by ordering lock acquisition consistently, keeping transactions short, accessing few rows with indexes, and choosing suitable isolation. Fix hot spots by splitting transactions or using queue-style processing.

Run autovacuum and ANALYZE to reclaim dead tuples and refresh planner stats, monitor bloat, transaction wraparound and long-running transactions, and tune checkpoints plus WAL retention. Schedule REINDEX and partitioning maintenance for hot tables and alert on replication lag. Test major upgrades on restored snapshots first.

Require TLS everywhere, authenticate with OAuth 2.0 or OIDC or API keys, enforce least-privilege authorization per endpoint, validate and sanitize all input, and apply rate limiting plus quotas. Add security headers, CORS allowlists, audit logging, secret rotation and dependency scanning. Return generic error messages so failures do not leak schema or stack details.

Avoid shared sessions by using signed JWT access tokens with short expiry plus refresh-token rotation, or a central identity provider with OAuth 2.0 and OIDC. Gateways validate tokens and forward identity claims while services enforce scopes locally. Rotate keys via JWKS, keep revocation lists, and use mTLS or service identities for service-to-service calls.

Enforce quotas with algorithms like token bucket for bursty traffic, leaky bucket for smooth output, or sliding-window counters for precision, keyed by API key, user or IP. Return 429 with Retry-After headers and document limits. Apply limits at the gateway or edge with counters in Redis, and separate strict abuse limits from generous per-plan business limits.

Never store plaintext or reversible passwords: hash with memory-hard adaptive functions like bcrypt, scrypt or Argon2id with unique per-user salts and tuned cost factors. Add pepper from a secrets manager, enforce strong password policies with breach-list checks, and use constant-time comparison plus rate-limited login attempts. Plan upgrades by rehashing on next login when costs increase.

The client redirects the user to the authorization server, which returns a short-lived code after consent, then the backend exchanges that code plus client secret for access and refresh tokens. Keep tokens out of URLs, validate state and PKCE for public clients, store secrets server side, and enforce scopes with short expiry. Never use implicit flow for new apps.

Use parameterized queries or prepared statements everywhere so user input is never concatenated into SQL text. Layer ORM safeguards, least-privilege database roles, input validation with allowlists, and WAF rules for legacy paths. Review code for string-built queries and test with injection payloads in CI.

HTTPS is HTTP over TLS, adding confidentiality, integrity and server authentication to plaintext HTTP. The handshake negotiates versions and ciphers, authenticates the server certificate chain, exchanges keys with forward-secret methods, then switches to encrypted records. Enforce modern TLS, HSTS, certificate rotation and full-chain validation.

CSRF tricks a logged-in browser into issuing unwanted state-changing requests using ambient cookies. Prevent it with SameSite cookies, anti-CSRF tokens validated server side, Origin and Referer checks, and GET methods kept read-only. Prefer custom headers or token-based auth for APIs plus re-authentication for sensitive actions.

Use short-lived access tokens with narrow scopes, rotate signing keys via JWKS, validate issuer, audience, expiry and algorithm strictly, and keep revocation or allowlists for sensitive actions. Store tokens in secure httpOnly cookies for browsers or secure storage for native apps, never in URLs. Prefer opaque refresh tokens with reuse detection.

Store secrets in a managed vault or cloud secrets manager with rotation, versioning and audit logs, never in code or images. Inject at runtime via environment or mounted files, scope per service with least privilege, and scan repos plus block commits containing keys. Rotate immediately on exposure and automate expiry for temporary credentials.

Cross-site scripting injects attacker scripts into pages viewed by others, stealing sessions or actions. Prevent it by encoding output per context, validating input with allowlists, setting Content Security Policy and httpOnly SameSite cookies, and using modern frameworks that escape by default. Audit stored and reflected inputs plus third-party scripts regularly.

Model permissions as granular actions, group them into roles, and assign roles to users or service identities with least privilege. Enforce checks server side on every endpoint, keep an auditable policy store, and support role hierarchies plus temporary elevation with expiry. Test with matrix cases covering allow and deny paths.

CORS lets browsers relax same-origin rules for trusted web origins accessing your APIs. Allowlist exact origins, limit methods and headers, set explicit max age, and never combine wildcard origins with credentials. Keep mobile and server clients on token auth since CORS only governs browsers.

Throttle by IP and account with exponential backoff, lock or challenge with CAPTCHA and MFA after thresholds, and monitor for credential stuffing with breach lists and device signals. Hash passwords strongly, return generic auth errors, and alert on distributed low-and-slow patterns. Offer WebAuthn or passkeys to reduce password risk.

Log authentication, authorization, key use, config changes and data access with actor, action, target, time and result in structured tamper-evident storage. Protect logs with restricted access, retention and integrity hashing plus offsite copies. Alert on anomalies and review trails in incident drills so evidence is complete.

Input validation rejects malformed data with allowlists for types, lengths, ranges and formats before business logic runs. Output encoding renders data safely for HTML, SQL, shell or JSON contexts to stop injection. Validate on the server even with client checks and encode at the sink where data is used.

Issue random session ids, store them server side or in signed encrypted cookies, rotate on login and privilege change, and expire with idle plus absolute timeouts. Set httpOnly Secure SameSite flags, bind to device signals where apt, and revoke centrally on logout or breach. Avoid localStorage for sensitive tokens in web apps.

Zero trust assumes no implicit trust by verifying every request with strong identity, least-privilege policy and continuous context like device and risk. Implement mTLS service identities, short-lived tokens, per-endpoint authorization and encrypted traffic plus microsegmentation. Centralize policy, log everything and rotate credentials automatically.

Offer TOTP, SMS fallback, push and WebAuthn passkeys with enrollment, recovery codes and rate-limited verification. Require step-up auth for sensitive actions, remember trusted devices carefully, and support admin-assisted recovery with identity proofing. Log MFA events and monitor bypass or fatigue attacks.

Vertical scaling adds CPU and RAM to one machine: simple but capped by hardware limits and a single point of failure. Horizontal scaling adds more machines behind a load balancer: effectively unlimited and fault-tolerant but requires stateless services with shared sessions and data partitioning. Start vertical for simplicity, go horizontal when traffic, availability or blast radius demands it.

Caching stores expensive results near the reader to cut latency and load. Use in-memory caches such as Redis or Memcached for sessions and query results, plus HTTP and CDN caching for static and edge-cacheable content. Define TTL and invalidation with cache-aside, write-through or write-behind patterns. Cache read-heavy, expensive and staleness-tolerant data, and plan for stampedes and cold starts.

A load balancer spreads requests across healthy backends using algorithms like round robin, least connections, weighted targets, IP hash and latency-based routing. Pair it with active health checks, connection draining, sticky sessions only when needed, and TLS termination at the edge. Layer DNS, edge and service-level balancing for global resilience.

Choose RabbitMQ for low-latency task queues with routing, acknowledgments and per-message control, and Kafka for high-throughput durable event logs with replay and stream processing. Model work queues and RPC-style tasks on RabbitMQ and event sourcing or analytics streams on Kafka. Consider ordering, retention, scaling and operational cost before deciding.

Monolith: a single deployable unit with simple local calls, transactions and debugging, which scales development friction as teams and code grow. Microservices: independently deployable services per bounded context that scale and release separately, at the cost of distributed transactions, networking, versioning and observability overhead.

Sagas split a distributed transaction into local steps with compensating actions instead of two-phase locking across services. Use choreography with events for simple flows and orchestration with a coordinator for complex branching. Make every step idempotent, track saga state durably, and add timeouts plus reconciliation for stuck flows.

Choose cache-aside for control, write-through for freshness, write-behind for write speed, and short TTLs plus versioned keys for rapidly changing data. Invalidate by key, tag or event on writes, use single-flight and jitter to avoid stampedes, and expose manual purge for incidents. Log hit rates per endpoint to tune TTLs empirically.

Autoscaling adds or removes instances from CPU, latency or queue-depth signals to meet demand without overprovisioning. Circuit breakers stop calling failing dependencies after thresholds, fail fast with fallbacks, and probe recovery with half-open trials. Combine both with bulkheads, timeouts and load shedding so one slow dependency cannot exhaust all resources.

Remove single points of failure with multi-zone deployment, redundant load balancers, replicated datastores and stateless app tiers. Add health checks with automatic failover, graceful degradation, retries with jitter, backups with tested restores, and runbooks plus game days. Measure with SLOs for availability and error budgets that gate risky releases.

Read replicas offload SELECT traffic and add regional locality while writes stay on the primary with async lag to monitor. Partitioning splits large tables by key or range to bound index size and maintenance. Combine both with caching and CQRS-style read models, and route analytics away from transactional primaries.

Observability combines structured logs, metrics with labels, and distributed traces plus profiles to explain any failure without redeploying. Correlate all three by trace and request ids, alert on SLO burn rates rather than raw spikes, and keep dashboards for golden signals like latency, traffic, errors and saturation. Review exemplars in incidents to close blind spots.

Isolate faults with timeouts, retries bounded by budgets, circuit breakers, bulkheads and load shedding plus graceful fallbacks. Enforce deadlines end to end, hedge only carefully, and shed low-priority traffic first. Test with fault injection and verify dashboards show fast failure instead of thread-pool exhaustion.

CDNs cache static assets and cacheable API responses at edge PoPs, cutting origin load and tail latency worldwide. Set Cache-Control, ETags and surrogate keys, purge by tag on deploy, and offload TLS, compression and image optimization. Keep dynamic private data uncached or cached briefly with proper Vary and auth rules.

Backpressure signals overload upstream so producers slow down instead of crashing consumers. Use bounded queues, rate limits, load shedding, reactive pull streams and autoscaling on queue depth. Expose queue metrics and shed or defer noncritical work first while preserving checkout and payment paths.

Generate short unique keys with base62 counters or hashes plus collision checks, store mappings in a sharded key-value store with heavy caching, and redirect with 301 or 302 plus analytics asynchronously. Rate-limit creation, scan for abuse, set expirations and custom aliases with uniqueness guards. Load-test redirect hot keys and edge caching.

Define SLOs for availability and latency percentiles, collect RED metrics per endpoint, and alert on burn rates with traces exemplars for diagnosis. Dashboard p95 and p99 separately from averages, track error budgets, and tie releases to budget policy. Review weekly to adjust thresholds and capacity.

Shard data across primaries with replicas, use hash tags to co-locate related keys, and let smart clients follow MOVED redirects. Plan for resharding, failover promotion, persistence trade-offs and hot-key mitigation with local caches or key splitting. Monitor memory, evictions and cross-slot errors in CI.

Model domain events as versioned immutable facts in topics with keyed partitioning for order, retention for replay, and schemas in a registry. Build idempotent consumers with transactional outbox publishing, dead-letter topics and lag alerts. Scale with consumer groups and document ordering plus exactly-once limits.