Backend engineering guides

Backend / Jul 2, 2026 / 5 min read

API Abuse Prevention Explained

Learn API abuse prevention for backend systems, including rate limits, authentication signals, quotas, bot patterns, logging, errors, and gateways.

• API Design
• Security
• Rate Limiting
• Backend

Backend / Jul 2, 2026 / 6 min read

API Authentication Best Practices

Learn API authentication best practices, including tokens, API keys, OAuth, mTLS, sessions, gateways, rotation, scopes, errors, and logging.

• API Design
• Authentication
• Security
• Backend

Backend / Jul 2, 2026 / 6 min read

Cookie vs Token Authentication

Compare cookie and token authentication for backend apps, including sessions, JWTs, CSRF, XSS, storage, CORS, mobile clients, and API tradeoffs.

• Authentication
• Cookies
• JWT
• Security

Backend / Jul 2, 2026 / 5 min read

Cookie Security Checklist

Use this backend cookie security checklist for HttpOnly, Secure, SameSite, CSRF, session rotation, prefixes, expiration, domains, and testing.

• Cookies
• Security
• Authentication
• Checklist

Backend / Jul 2, 2026 / 5 min read

CORS Preflight Explained

Learn how CORS preflight requests work, including OPTIONS handling, allowed methods, headers, credentials, caching, errors, and backend mistakes.

• CORS
• Security
• API Design
• HTTP

Backend / Jul 2, 2026 / 5 min read

OAuth Client Credentials Flow Explained

Learn the OAuth client credentials flow for service-to-service APIs, including clients, secrets, scopes, tokens, rotation, and security risks.

• OAuth
• Authentication
• Backend
• API Design

Backend / Jul 2, 2026 / 4 min read

OAuth Scopes Explained

Learn OAuth scopes for backend APIs, including permissions, consent, least privilege, access tokens, naming, validation, and common mistakes.

• OAuth
• Authentication
• Authorization
• API Design

Backend / Jul 2, 2026 / 5 min read

Security Event Logging Explained

Learn security event logging for backend systems, including auth events, API abuse signals, safe metadata, alerting, retention, and mistakes.

• Security
• Observability
• Backend
• Audit Logs

Backend / Jul 2, 2026 / 5 min read

Service Accounts Explained

Learn service accounts for backend systems, including machine identity, API access, least privilege, secrets, rotation, audit logs, and risks.

• Security
• Authentication
• Access Control
• Backend

Backend / Jul 1, 2026 / 6 min read

Audit Logs Explained for Backend Systems

Learn what audit logs are in backend systems, including actor, action, resource, timestamp, metadata, retention, privacy, and investigation workflows.

• Security
• Audit Logs
• Backend
• Observability

API Design / Jul 1, 2026 / 5 min read

API Pagination Metadata Best Practices

Learn how to design pagination metadata for REST APIs, including pageInfo, cursors, hasNextPage, limits, totals, links, sorting, and compatibility.

• API Design
• REST
• Pagination
• Backend

System Design / Jul 1, 2026 / 6 min read

Database Connection Pooling Explained

Learn database connection pooling for backend systems, including pool size, timeouts, leaks, max connections, queues, monitoring, and common mistakes.

• System Design
• Databases
• Performance
• Backend

System Design / Jul 1, 2026 / 6 min read

Database Migration Rollback Explained

Learn database migration rollback strategies, including backward-compatible changes, expand-contract migrations, backups, deploy order, and recovery plans.

• System Design
• Databases
• Operations
• Backend

Java / Jul 1, 2026 / 5 min read

HashMap Collision Handling Explained

Learn how HashMap collision handling works in Java, including buckets, hashCode, equals, tree bins, load factor, bad keys, and performance.

• Java
• HashMap
• Collections
• Performance

Java / Jul 1, 2026 / 5 min read

Java equals and hashCode Explained

Learn Java equals and hashCode contracts, why they matter for HashMap and HashSet, common mistakes, records, mutability, and testing.

• Java
• Java Collections
• HashMap
• HashSet

API Design / Jul 1, 2026 / 5 min read

JSON Schema vs OpenAPI Schema

Compare JSON Schema and OpenAPI Schema for backend API contracts, including validation, documentation, examples, tooling, and compatibility.

• API Design
• OpenAPI
• JSON Schema
• Backend

Backend / Jul 1, 2026 / 6 min read

Least Privilege Explained for Backend Developers

Learn the principle of least privilege for backend systems, including users, services, API keys, database roles, cloud permissions, and operational tradeoffs.

• Security
• Authorization
• Backend
• Access Control

System Design / Jul 1, 2026 / 5 min read

N+1 Query Problem Explained

Learn the N+1 query problem in backend apps, including ORM loading, SQL examples, eager loading, batching, joins, query counts, and fixes.

• System Design
• Databases
• Performance
• Backend

Algorithms / Jul 1, 2026 / 4 min read

Prefix Sum Algorithm Explained

Learn prefix sums with Java examples, range-sum queries, subarray patterns, difference arrays, complexity, and when preprocessing is worth it.

• Algorithms
• Prefix Sum
• Big-O
• Java

API Design / Jul 1, 2026 / 6 min read

REST API Design Checklist

Use this REST API design checklist to review resources, methods, status codes, errors, pagination, idempotency, versioning, auth, and OpenAPI docs.

• API Design
• REST
• Checklist
• Backend

Backend / Jul 1, 2026 / 6 min read

Secret Management Explained for Backend Developers

Learn secret management for backend apps, including environment variables, secret stores, rotation, least privilege, logging risks, and deployment workflows.

• Security
• Secrets
• Backend
• DevOps

Algorithms / Jul 1, 2026 / 5 min read

Sliding Window Algorithm Explained

Learn the sliding window algorithm pattern with Java examples, fixed windows, variable windows, two pointers, complexity, and common mistakes.

• Algorithms
• Sliding Window
• Big-O
• Java

Backend / Jul 1, 2026 / 5 min read

Spring Boot REST Controller Explained

Learn Spring Boot REST controllers, including @RestController, request mappings, DTOs, validation, status codes, error responses, and testing.

• Spring Boot
• REST
• Backend
• API Design

Algorithms / Jul 1, 2026 / 5 min read

Two Pointers Algorithm Explained

Learn the two pointers algorithm pattern with Java examples for sorted arrays, pairs, partitions, linked lists, complexity, and common mistakes.

• Algorithms
• Two Pointers
• Big-O
• Java

Backend / Jun 30, 2026 / 5 min read

API Key Design Best Practices for Backend APIs

Learn practical API key design best practices, including key format, prefixes, hashing, scopes, rotation, rate limits, audit logs, and safe storage.

• Security
• API Design
• API Keys
• Backend

Backend / Jun 30, 2026 / 5 min read

API Key vs OAuth Token: Practical Backend Differences

Compare API keys and OAuth tokens for backend APIs, including identity, scopes, rotation, expiration, user context, service access, and security tradeoffs.

• Security
• API Design
• OAuth
• Authentication

Java / Jun 30, 2026 / 4 min read

HashSet vs TreeSet in Java

Compare HashSet and TreeSet in Java by ordering, uniqueness, contains performance, null handling, memory cost, and practical backend use cases.

• Java Collections
• HashSet
• TreeSet
• Performance

Backend / Jun 30, 2026 / 5 min read

MFA Explained for Web Apps

Learn how multi-factor authentication works in web apps, including TOTP, WebAuthn, backup codes, recovery flows, step-up checks, and backend tradeoffs.

• Authentication
• Security
• MFA
• Backend

API Design / Jun 30, 2026 / 4 min read

OpenAPI Explained for Backend Developers

Learn how OpenAPI describes REST APIs, including paths, operations, schemas, examples, auth, versioning, code generation, and contract review.

• API Design
• OpenAPI
• REST
• Backend

Backend / Jun 30, 2026 / 5 min read

Password Hashing Explained for Backend Developers

Learn password hashing basics for backend systems, including salts, slow hashes, peppers, verification, resets, storage risks, and common mistakes.

• Authentication
• Security
• Password Hashing
• Backend

Java / Jun 30, 2026 / 4 min read

Queue vs Deque in Java

Compare Queue and Deque in Java, including FIFO queues, double-ended operations, ArrayDeque, LinkedList, stack usage, and practical backend defaults.

• Java Collections
• Queue
• Deque
• ArrayDeque

API Design / Jun 30, 2026 / 4 min read

PUT vs PATCH in REST APIs

Compare PUT and PATCH in REST APIs, including replacement vs partial updates, idempotency, validation, status codes, and backend implementation choices.

• API Design
• REST
• HTTP
• Backend

Backend / Jun 30, 2026 / 4 min read

RBAC vs ABAC: Access Control Models Explained

Compare RBAC and ABAC for backend authorization, including roles, attributes, policies, ownership checks, tenant context, and practical tradeoffs.

• Authorization
• Security
• Access Control
• Backend

Backend / Jun 30, 2026 / 5 min read

Refresh Token Rotation Explained for Backend Developers

Learn how refresh token rotation works, why reuse detection matters, and how backend teams can design safer token refresh, logout, and revocation flows.

• Authentication
• Security
• OAuth
• JWT

Backend / Jun 30, 2026 / 5 min read

SameSite Cookies Explained for Backend Developers

Learn how SameSite cookies affect browser authentication, CSRF risk, cross-site requests, OAuth redirects, iframes, and backend cookie design.

• Cookies
• Security
• CSRF
• Authentication

Backend / Jun 30, 2026 / 4 min read

Secure HTTP Headers Explained for Backend Developers

Learn practical secure HTTP headers for backend apps, including HSTS, CSP, X-Content-Type-Options, frame protection, referrer policy, and cookie-related limits.

• Security
• HTTP
• Headers
• Backend

Backend / Jun 30, 2026 / 4 min read

Session Fixation Explained for Backend Developers

Learn what session fixation is, how it affects web authentication, why session rotation matters, and how backend teams can prevent it.

• Authentication
• Security
• Sessions
• Backend

Java / Jun 30, 2026 / 4 min read

TreeMap vs HashMap in Java

Compare TreeMap and HashMap in Java by key ordering, lookup complexity, range queries, null handling, memory overhead, and backend use cases.

• Java Collections
• TreeMap
• HashMap
• Performance

API Design / Jun 30, 2026 / 5 min read

Webhook Signature Verification Explained

Learn how webhook signature verification works, including HMAC headers, raw request bodies, timestamps, replay protection, secret rotation, and safe failures.

• API Design
• Webhooks
• Security
• Backend

API Design / Jun 29, 2026 / 4 min read

API Gateway Explained

Learn what an API gateway does in backend architecture, including routing, authentication, rate limiting, observability, and tradeoffs.

• API Design
• System Design
• Backend
• Architecture

Backend / Jun 29, 2026 / 4 min read

Authorization vs Authentication

Compare authentication and authorization in backend systems, including identity checks, permissions, roles, scopes, sessions, tokens, and API enforcement.

• Authentication
• Authorization
• Security
• Backend

System Design / Jun 29, 2026 / 4 min read

Background Jobs Explained

Learn how background jobs work in backend systems, including queues, workers, retries, scheduling, idempotency, and monitoring.

• System Design
• Background Jobs
• Message Queues
• Backend

System Design / Jun 29, 2026 / 5 min read

Caching Strategies Explained

Learn common backend caching strategies, including cache-aside, write-through, write-behind, TTLs, invalidation, and cache stampede risks.

• System Design
• Caching
• Performance
• Backend

System Design / Jun 29, 2026 / 4 min read

Circuit Breaker Pattern Explained

Learn how the circuit breaker pattern protects backend services from cascading failures, with closed, open, and half-open states.

• System Design
• Resilience
• Distributed Systems
• Backend

Backend / Jun 29, 2026 / 4 min read

CORS Explained for Backend Developers

Learn how CORS works for backend APIs, including origins, preflight requests, credentials, allowed headers, cookies, security limits, and common mistakes.

• CORS
• Security
• API Design
• Backend

System Design / Jun 29, 2026 / 5 min read

Database Sharding Explained

Learn what database sharding is, when backend systems need it, how shard keys work, and what tradeoffs sharding creates.

• System Design
• Databases
• Scalability
• Backend

System Design / Jun 29, 2026 / 4 min read

Database Transactions Explained

Learn what database transactions are, why ACID matters, how commits and rollbacks work, and what backend developers should know.

• System Design
• Databases
• Transactions
• Backend

System Design / Jun 29, 2026 / 4 min read

Distributed Locks Explained

Learn what distributed locks are, when backend systems use them, why they are risky, and what safer alternatives to consider.

• System Design
• Distributed Systems
• Concurrency
• Backend

System Design / Jun 29, 2026 / 5 min read

Eventual Consistency Explained

Learn what eventual consistency means in distributed systems, why stale reads happen, and how backend teams design around them.

• System Design
• Distributed Systems
• Consistency
• Backend

Backend / Jun 29, 2026 / 4 min read

JWT Claims Explained

Learn common JWT claims for backend authentication, including sub, iss, aud, exp, nbf, iat, jti, scopes, roles, tenant context, and validation mistakes.

• JWT
• Authentication
• Security
• OAuth

System Design / Jun 29, 2026 / 5 min read

Load Balancing Explained

Learn how load balancing distributes traffic across backend servers, including algorithms, health checks, sticky sessions, and tradeoffs.

• System Design
• Scalability
• Networking
• Backend

System Design / Jun 29, 2026 / 4 min read

Message Queues Explained

Learn how message queues work in backend systems, including producers, consumers, retries, dead-letter queues, ordering, and idempotency.

• System Design
• Message Queues
• Distributed Systems
• Backend

Backend / Jun 29, 2026 / 5 min read

OAuth 2.0 vs OpenID Connect

Compare OAuth 2.0 and OpenID Connect for backend developers, including authorization, login, ID tokens, access tokens, scopes, and common mistakes.

• Authentication
• OAuth
• OpenID Connect
• Security

API Design / Jun 29, 2026 / 4 min read

REST API Error Handling Best Practices

Learn practical REST API error handling patterns, including status codes, stable error codes, field errors, request IDs, and safe messages.

• API Design
• REST
• Error Handling
• Backend

System Design / Jun 29, 2026 / 5 min read

Retry Patterns Explained

Learn safe backend retry patterns, including exponential backoff, jitter, retry budgets, idempotency, and when not to retry.

• System Design
• Resilience
• Distributed Systems
• Backend

API Design / Jun 29, 2026 / 4 min read

Webhooks Explained

Learn how webhooks work in backend systems, including event delivery, signatures, retries, idempotency, and common design mistakes.

• API Design
• Webhooks
• Distributed Systems
• Backend

API Design / Jun 28, 2026 / 4 min read

API Versioning Explained

Learn practical API versioning strategies, including URL versions, header versions, backward compatibility, deprecation, and migration plans.

• API Design
• REST
• Versioning
• Backend

Algorithms / Jun 28, 2026 / 4 min read

Binary Search Explained

Learn how binary search works, when it applies, common off-by-one mistakes, and how to implement iterative binary search in Java.

• Algorithms
• Binary Search
• Big-O
• Java

System Design / Jun 28, 2026 / 4 min read

Database Indexes Explained

Learn how database indexes work, why they speed up reads, when they slow down writes, and how backend developers should choose indexes.

• System Design
• Databases
• Indexes
• Performance

System Design / Jun 28, 2026 / 4 min read

Optimistic Locking Explained

Learn how optimistic locking prevents lost updates in backend systems using version columns, compare-and-swap updates, and 409 conflicts.

• System Design
• Databases
• Concurrency
• API Design

API Design / Jun 28, 2026 / 5 min read

Rate Limiting in APIs Explained

Learn how API rate limiting works, including fixed windows, sliding windows, token buckets, 429 responses, headers, and backend tradeoffs.

• API Design
• Rate Limiting
• HTTP
• Backend

Algorithms / Jun 28, 2026 / 4 min read

Top K Elements Explained

Learn common ways to solve top K elements problems with sorting, heaps, and Java PriorityQueue, including complexity tradeoffs.

• Algorithms
• Heap
• PriorityQueue
• Big-O

Java / May 10, 2026 / 6 min read

Time Complexity of Java Collections

A practical reference for Java collection time complexity, including ArrayList, LinkedList, HashMap, TreeMap, HashSet, and PriorityQueue.

• Java
• Collections
• Big-O
• Performance

Backend / May 3, 2026 / 7 min read

CSRF vs XSS: Key Differences for Backend Developers

Compare CSRF and XSS attacks for backend developers, including how they work, why cookies and tokens matter, and practical defenses.

• Security
• CSRF
• XSS
• Authentication

Backend / Apr 19, 2026 / 6 min read

OAuth 2.0 Explained for Backend Developers

A backend-focused OAuth 2.0 guide covering roles, authorization code flow, PKCE, scopes, tokens, client credentials, and common mistakes.

• Authentication
• OAuth
• Security
• Backend

Backend / Apr 12, 2026 / 6 min read

Access Token vs Refresh Token

Compare access tokens and refresh tokens in backend authentication, including lifetime, storage, rotation, revocation, and security tradeoffs.

• Authentication
• Security
• JWT
• OAuth

API Design / Apr 5, 2026 / 5 min read

Pagination Strategies for REST APIs

Compare offset, cursor, and keyset pagination for REST APIs, including tradeoffs, response shapes, sorting, and backend performance.

• REST
• API Design
• Pagination
• Performance

API Design / Mar 29, 2026 / 6 min read

Idempotency in APIs Explained

Learn what idempotency means in API design, why retries create duplicate actions, and how idempotency keys protect backend workflows.

• API Design
• REST
• Idempotency
• Distributed Systems

API Design / Mar 22, 2026 / 5 min read

REST API Status Codes Explained

Understand the HTTP status codes backend developers use most often in REST APIs, including 200, 201, 400, 401, 404, 409, and 500.

• REST
• HTTP
• API Design
• Status Codes

Java / Mar 15, 2026 / 4 min read

ConcurrentHashMap Explained

A practical explanation of ConcurrentHashMap in Java, including thread safety, atomic methods, iteration behavior, and common mistakes.

• Java
• ConcurrentHashMap
• Concurrency
• Collections

Java / Mar 8, 2026 / 4 min read

HashMap Load Factor Explained

Learn what HashMap load factor means in Java, how it affects resizing, memory usage, collision risk, and lookup performance.

• Java
• HashMap
• Collections
• Performance

Java / Mar 1, 2026 / 4 min read

ArrayList vs LinkedList in Java

Compare ArrayList and LinkedList in Java by access patterns, insertion cost, memory overhead, and practical backend usage.

• Java
• Collections
• ArrayList
• LinkedList

Algorithms / Feb 4, 2026 / 4 min read

Big-O Notation Explained for Backend Developers

Learn Big-O notation with practical backend examples, including arrays, hash maps, sorting, nested loops, and database-like thinking.

• Big-O
• Algorithms
• Interview Prep

Backend / Jan 28, 2026 / 5 min read

JWT vs Session Authentication: Practical Backend Tradeoffs

Understand JWT and server-side session authentication, including storage, revocation, scaling, security risks, and common backend use cases.

• Authentication
• JWT
• Security

API Design / Jan 21, 2026 / 5 min read

REST vs RPC: How to Choose an API Style

Compare REST and RPC API styles through resources, actions, payload design, caching, versioning, and backend team workflows.

• REST
• RPC
• System Design

Java / Jan 14, 2026 / 4 min read

Java PriorityQueue Explained with Practical Examples

Learn how Java PriorityQueue works, when to use it, how ordering is defined, and common pitfalls around iteration and custom comparators.

• Java Collections
• PriorityQueue
• Algorithms

Java / Jan 8, 2026 / 4 min read

HashMap vs Hashtable in Java: Key Differences

Compare HashMap and Hashtable in Java, including synchronization, null keys, performance, legacy status, and modern alternatives.

• Java Collections
• HashMap
• Concurrency

Categories

• Backend (30)
• API Design (15)
• System Design (15)
• Java (11)
• Algorithms (6)

Tags

• Backend (42)
• Security (28)
• API Design (24)
• Authentication (19)
• System Design (17)
• REST (11)
• Java (10)
• Performance (10)
• OAuth (8)
• Algorithms (7)
• Big-O (7)
• Databases (7)
• Distributed Systems (7)
• Java Collections (6)
• Collections (5)
• HashMap (5)
• HTTP (5)
• JWT (5)
• Authorization (4)
• Concurrency (4)