Page 1

(This page has no text content)

Page 2

(This page has no text content)

Page 3

Backend Developer in 30 Days Acquire Skills on Api Designing, Data Management, Application Testing, Deployment, Security and Performance Optimization Pedro Marquez-Soto www.bpbonline.com

Page 4

Copyright © 2022 BPB Online All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor BPB Online or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book. BPB Online has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, BPB Online cannot guarantee the accuracy of this information. Group Product Manager: Marianne Conor Publishing Product Manager: Eva Brawn Senior Editor: Connell Content Development Editor: Melissa Monroe Technical Editor: Anne Stokes Copy Editor: Joe Austin Language Support Editor: Justin Baldwin Project Coordinator: Tyler Horan Proofreader: Khloe Styles Indexer: V. Krishnamurthy Production Designer: Malcolm D'Souza Marketing Coordinator: Kristen Kramer First published: August 2022 Published by BPB Online WeWork, 119 Marylebone Road London NW1 5PU UK | UAE | INDIA | SINGAPORE ISBN 978-93-55513-212 www.bpbonline.com

Page 5

Dedicated to My beloved wife Alejandra & My sons Santiago and Bruno

Page 6

About the Author Pedro Marquez Soto is a full-stack software developer with a Master of Science in Computer Science and Machine Learning. He has more than 10 years of professional experience in multiple roles that cover application security, back-end, front-end development, and infrastructure development. He currently works as a full-stack engineer at LinkedIn.

Page 7

Acknowledgement There are a few people I want to thank for the continued and ongoing support they have given me during the writing of this book. First and foremost, I thank my wife and friend Alejandra for her unconditional love and support in all my professional ventures. This book was only possible because she believed in me; she had the patience of having a husband who spent hours locked in the office, writing. I wrote this book in the middle of a pandemic while at the same time I was completing my master's degree. The only thing that kept me on track was having the safe space of a loving family and their support for me to pursue my passions. I want to thank my mom, Josefina, who has worked tirelessly to provide her kids with an education; without all her hard work and love I would have never had acquired the knowledge needed for writing this book. I also want to thank my father Pedro for teaching me to never give up, especially when life gets hard. I am grateful to all the official and unofficial mentors I’ve found during my lifetime. Managers and other smart people I’ve met in the past decade who gave me the opportunity of working on interesting projects that led to constant professional improvement. These people were honest when my code was not as good as it could be and showed me how world-class software developers work. My gratitude also goes to the team at BPB Publications for giving me the opportunity to write my first book and providing guidance during this process that was new to me. They gave me the right amount of freedom and support that allowed me to complete this daunting task. BPB Publications is the best home this book could have, and for that, I will be forever thankful. Even if my name is on the cover of this book, this project is a team effort. All these people are co-authors, and no author should be ungrateful enough to forget that.

Page 8

Preface This book covers the process of building large-scale software applications from the point of view of a back-end developer. More than a tutorial on specific tools or frameworks, this book outlines principles and processes shared across the multiple tech stacks. Tools and frameworks change with time: they are replaced by newer stacks; the patterns, however, remain the same. The goal is to show you how things work and why they work the way they do. This book connects different areas commonly isolated in educational material: API development, database integration, application security, and deployment processes. It gives an integral vision of how the largest software companies build software capable of serving millions of users. This vision benefits people starting their careers as software developers and those who have spent most of their careers working on only one of these areas. This book has 12 chapters chronologically ordered to follow the phases of a software development project. Ideally, you could take this book with you and read across each chapter in order as your project evolves. Each chapter builds on the previous, so it is advised for you to read from start to end. However, each chapter is also self-contained enough for you to return to any of them when you need to refresh your knowledge. The first part of the book covers the essential aspects of back-end development. It outlines the process of converting business needs into requirements, defining elegant APIs that are flexible enough to evolve with the application, and choosing the correct type of database. This first part also offers a deep dive into the inner workings of web-based applications, building a robust mental model that will allow you to fully grasp the abstractions built on top of them. The second part covers patterns and processes needed to build quality into software applications: Testing, application security, error and log management, framework adoption, and continuous integration and

Page 9

deployment. These concepts are the basis for the daily work of software developers across the globe. The third and last part of the book serves two purposes: Describe how to jump from simple apps to large-scale, distributed systems and concepts that you can use to advance your career and become a senior developer. Chapter 1 covers the topics of problem-solving and requirements gathering. It provides background on the importance of software applications as tools to solve problems. This chapter gives you useful heuristics to successfully recollect business requirements in an iterative process. Then, the chapter provides a high-level view of large-scale software applications and all the components and tools that address the functional and non-functional requirements for the project. Chapter 2 is a deep dive into web-based applications and the client-server architecture. It details the inner workings of web servers, guiding you to create your own Java-based web server and compare it with production- ready servers like NodeJS’s Express. This detailed view helps you understand the “magic” behind these tools, which is a critical skill for becoming a senior developer. Chapter 3 disambiguates the term “API”. It explains what APIs are, why they are useful to back-end developers, and how they fit in the process of creating an application. Then, the chapter guides you on how to design flexible, data-driven APIs and how to choose the right tools to implement them: REST, GraphQL, and gRPC. Chapter 4 will cover state and data management, which includes databases. It provides background on why we need databases, how to model real-life data, and how to choose the proper database for your business needs. This chapter covers the differences between SQL and NoSQL, and highlights the differences between the most common products for each, like relational, document, and graph databases. Chapter 5 explores the area of testing. It details the manual and automated testing process and highlights the differences between concepts like mocks, stubs, and test doubles. This chapter also provides good practices for writing unit and integration tests and their differences. Then, it describes other areas of non-functional testing like performance and security testing.

Page 10

Chapter 6 covers application security. This chapter defines the concepts used by application security experts that any software developer should know. It describes how to integrate authentication and authorization services into the application, including industry standards like OAuth2, SAML, and OpenID Connect. This chapter also covers some of the most common security vulnerabilities and advises how to prevent them. Chapter 7 explains the topic of error and log management in software applications. It highlights how some coding languages deal with errors, how to find errors in applications deployed to production environments, and how to centralize and monitor errors in distributed applications using tools like Logstash, Elastisearch, and Kibana. Chapter 8 covers a deep dive into application frameworks. The chapter explains what frameworks are, what they are used for, and the patterns they use to solve everyday challenges for back-end developers. It then introduces popular frameworks like Java’s Spring and Hibernate and Python’s Django. It contrasts how patterns like MVC are implemented in these frameworks and provides the groundwork for developers to pick the proper framework for their use case. Chapter 9 describes how to deploy an application to a production environment. It gives some historical background on how applications have been delivered to users, the challenges faced, and how modern CI/CD (Continuous integration and deployment) flows enable development teams to deliver their applications fast. We also explore the concept of replicable environments through virtualization using Virtual Machines and Docker containers and how they integrate into the CI/CD process. Chapter 10 presents advanced topics for creating large-scale, distributed applications. The chapter covers how to measure performance to find improvement opportunities. Then, we explore techniques to improve performance like caching, asynchronous architectures, and asynchronous programming through the concepts of “Promises” and “Futures”. It presents some tools used to increase performance in large applications like Redis and Kafka. Chapter 11 takes a step back and integrates every previous chapter into one process for designing a software application. The chapter describes a step- by-step approach to converting requirements into technical specs, estimating server and storage size requirements, and principles used for

Page 11

scaling apps. This process is a blueprint that is especially useful for system design interviews. Chapter 12 the last chapter in this book, outlines career advice for back- end developers looking to become senior developers. It describes the typical responsibilities of both junior and senior developers, and it provides guidelines for preparing for tech interviews, finding mentors, and finding resources to keep increasing your technical knowledge.

Page 12

Code Bundle and Coloured Images Please follow the link to download the Code Bundle and the Coloured Images of the book: https://rebrand.ly/sueh55f The code bundle for the book is also hosted on GitHub at https://github.com/bpbpublications/Backend-Developer-in-30-Days. In case there's an update to the code, it will be updated on the existing GitHub repository. We have code bundles from our rich catalogue of books and videos available at https://github.com/bpbpublications. Check them out! Errata We take immense pride in our work at BPB Publications and follow best practices to ensure the accuracy of our content to provide with an indulging reading experience to our subscribers. Our readers are our mirrors, and we use their inputs to reflect and improve upon human errors, if any, that may have occurred during the publishing processes involved. To let us maintain the quality and help us reach out to any readers who might be having difficulties due to any unforeseen errors, please write to us at : errata@bpbonline.com Your support, suggestions and feedbacks are highly appreciated by the BPB Publications’ Family. Did you know that BPB offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to

Page 13

the eBook version at www.bpbonline.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at: business@bpbonline.com for more details. At www.bpbonline.com, you can also read a collection of free technical articles, sign up for a range of free newsletters, and receive exclusive discounts and offers on BPB books and eBooks.

Page 14

Piracy If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at business@bpbonline.com with a link to the material. If you are interested in becoming an author If there is a topic that you have expertise in, and you are interested in either writing or contributing to a book, please visit www.bpbonline.com. We have worked with thousands of developers and tech professionals, just like you, to help them share their insights with the global tech community. You can make a general application, apply for a specific hot topic that we are recruiting an author for, or submit your own idea. Reviews Please leave a review. Once you have read and used this book, why not leave a review on the site that you purchased it from? Potential readers can then see and use your unbiased opinion to make purchase decisions. We at BPB can understand what you think about our products, and our authors can see your feedback on their book. Thank you! For more information about BPB, please visit www.bpbonline.com.

Page 15

Table of Contents 1. Building Multi-User Apps Structure Objective Digital transformation and a little history Digital transformation and the Internet Software transformation Designing apps to solve real-world problems Caring for user problems as a back-end developer Finding a problem to solve Define a sample use case: The Pizza Place ordering system. Defining functional and non-functional requirements An ineffective way of collecting requirements The requirement definition cycle Find out what is the problem your client is trying to solve Get a detailed picture of the business. Request the help of one of your client’s domain-experts Learn how the existing process works today Build prototypes and revise requirements Use case: Defining requirements for the Pizza Place The modern system design: a ten thousand-feet view Getting the front-end out of the way Building blocks Conclusion Questions 2. The Client-Server Architecture Structure Objectives Architecture details Abstraction layer: Frontend client and backend client Abstraction layer: Data access service client, database server HTTP: The language of the web

Page 16

Implementing a web server The main process Serving a response Multi-user support with multi-threading Using a production-ready server Enabling HTTPS in Express Layered architecture: Fully splitting the client from the server Splitting clients Client versus server computing Web servers as stateless services Storing session data Use case: Applying a client-server architecture to the Pizza Place app Client server versus peer-to-peer Conclusion Questions References 3. Designing APIs Structure Objectives What is an API? Functions as contracts Interfaces and design patterns Remote APIs: RPC, SOAP, REST, and GraphQL Building a remote API with RPC/gRPC Build the gRPC server Build the gRPC client When to use gRPC SOAP and web services Building REST APIs Actions versus HTTP request methods Naming resources Singular versus plural Relationships Versioning Caching Effective REST APIs: HATEOAS

Page 17

Building APIs with GraphQL Building standalone APIs Standalone API: Headless CMS Standalone API: Public APIs Use case: Designing a remote API for the Pizza Corner Conclusion Questions References 4. End-to-End Data Management Structure Objectives Defining the application state Hardware storage Understanding in-memory data storage In-memory cache In-memory databases Simple storage in text and binary files Understanding complex data storage SQL or NoSQL? Document databases High locality Few relationships Unstructured data Relational databases Models are related but independent Multiple relationships Fixed structure Normalization Graph databases Data with a lot of connections Data where the relationships are first-class citizens Scalability File storage repositories Beyond technical requirements Indexing Reducing time complexity

Page 18

Example: Benchmark the impact of indexes in SQLite Backup and recovery Backup database files Creating backups with activity logs Backup through replication Tackling gaps in backups Designing data storage in a production system Choosing a deployment strategy Database and application share a server Deploy database in its own server(s) Embedded databases Combining databases to approach complex use cases Use Case: Defining a data model for the Pizza Place application Requirement: Users should be able to see the menu on their phones or computers No attributes, fixed size of ingredients No attributes, dynamic list of ingredients With attributes, dynamic size Choosing a data store for storing the pizza menu The winner Scaling the database Conclusion Questions References 5. Automating Application Testing Structure Objectives Certainty through testing Manual testing Types of manual tests Building effective manual tests Creating a test plan Executing the test plan Creating detailed reports Validating fixes Update test plan

Page 19

Advantages of manual testing Explorability Horizontal validation User-centered vision Manual testing and Agile Let others test your code Automated testing Unit testing Testing in isolation: Doubles, stubs, and mocks Isolated code is easier to debug Isolating test dependencies Test mocks Stubs versus mocks Coverage To use coverage or not to use it Test-driven development Integration testing with Selenium Defining a test environment for integration testing Simulate a test environment close to production Testing and CI/CD Other automated tests: Static code analyzers Defining effective test cases Defining a single use case per test Do not mock everything On equal conditions, prefer unit tests over integration tests Non-functional testing Application security and penetration testing Load testing Performance testing Accessibility testing Conclusion References 6. Securing Applications Structure Objectives The CIA triad: Confidentiality, Integrity, and Availability

Page 20

Confidentiality Loss of confidentiality Integrity Loss of integrity Availability Loss of availability Access Control: Authentication and authorization Authentication Identification: Username and password Problems with passwords Best practices for passwords Identification: Multi-factor authentication Single Sign-On Authorization Roles and groups Least privilege principle Use case: Implementing basic authentication and authorization for the Pizza Place Identify user roles Building an authentication service Define user management storage Define password-related protections Build web forms for signup and login Apply authorization controls Translate a high-level authorization map to implementation details Using scopes to check authorization Test access control Federated authorization Pros and cons of federated authentication Security Assertion Markup Language (SAML) OpenID OAuth2 Terms Request an authorization code Request an access token The implicit flow

Tip the Site

Backend Developer in 30 Days (Pedro Marquez)（Z-Library）

Backend Developer in 30 Days (Pedro Marquez)（Z-Library）

Registered users can read the full content for free

AI Reading Assistant

Passage locations

Recommended for You

Tip the Site