Learn Express, Flow and Lighthouse

Express is a minimal and flexible Node.js web application framework that provides a robust set of features for web and mobile applications.

express

Learn about security headers by adding them to an Express app in a step-by-step guide.

We're going to cover:
- default request headers
- what are security headers
- why security headers are important
- how to add security headers using Helmet
- how to configure the newly added security headers

Add Security Headers to an Express app

We'll create our client-server using the `express` and `cors` packages

Express will be used to create our HTTP application. We'll need it to post to our endpoints and listen to our port.

We need the `cors` package to make cross-origin requests since the front-end will be a different origin than the server.

Create an OAuth Client-Server for code/token exchange

 Every developer who has attempted to demystify OAuth 2.0 must be presented with mind-bugging complicated flow diagrams. It becomes worse when you try to understand all the terminologies of OAuth 2.0 and Open ID protocols.

There is no getting around the OAuth 2.0 flow being complicated with back and forth between your browser, the service you are authenticating with, and the application you want to access. 

This course gets straight to the point without any application code distracting you from the core takeaway -- You will learn how to authenticate and authorize yourself using GitHub as your Auth Server.

We'll first cover the OAuth 2.0 flow for authentication and then integrate the Open ID protocol for authorization.

[**LIVE EVENT**: Register here for a live webinar with Christian on OAuth.](https://egghead.zoom.us/webinar/register/WN_Sxy1FEcoTea8UA6F7EDzLw) Bring any questions you have from taking this course!

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

Add Github Login to Your Web App with OAuth 2.0

React is one of the web’s most popular frameworks for building JavaScript applications. 

If you know what you’re doing, React can drastically simplify how you build, use, and maintain code.

Whether you’re a React newbie or you’re ready for advanced techniques, you can level-up with egghead. Explore our in-depth courses, lessons, and community resources to build more powerful applications and crack open your career.

react

Role-Based Access Control (RBAC) is the idea of grouping permissions together by a role. Users are assigned a role through the Auth0 dashboard the corresponding permissions are placed on the user's access token (JWT) after authenticating. That access token can be extracted by an Auth0 SDK (this video uses JavaScipt/ ReactJS) and sent to a custom server. 

Server Side logic (this video is based on NodeJS and ExpressJS), can then check for specific permissions and then allow or reject certain resources. 

-------------

Starting point- https://github.com/twclark0/roles-scopes-node-auth0/tree/roles-beginning

Ending point- https://github.com/twclark0/roles-scopes-node-auth0/tree/roles-final

Role Based Auth in NodeJS with ExpressJS and Auth0

JavaScript® (often shortened to JS) is a lightweight, interpreted, object-oriented language with first-class functions, most known as the scripting language for Web pages, but used in many non-browser environments as well such as node.js or Apache CouchDB. It is a prototype-based, multi-paradigm scripting language that is dynamic, and supports object-oriented, imperative, and functional programming styles.

javascript

Nx is not only capable of scaffolding frontend projects, but it also supports a lot of backend setups. In this specific lesson, we're going to explore the setup we previously generated, specifically inspecting how passing `--frontentProject` to the Express.js schematic automatically sets up a [Webpack dev proxy](https://webpack.js.org/configuration/dev-server/#devserverproxy) to make it easy to call the backend API.

Connect to an Express.js API from a React app in an Nx Workspace

When we talk about monorepos, we don't talk about the frontend specifically. Quite contrary: an Nx workspace can also host our backend apps. This opens up completely new possibilities in terms of exchanging code between the frontend and corresponding backend API. But before diving deeper into this topic, let's first learn about how we can use the `@nrwl/express` package to generate a [Express](https://expressjs.com/) based API application.

Create an Express Backend API in an Nx Workspace

In this lesson, we will use Auth0 to generate a JWT that we can use to validate future requests to our server.

We will then return that token and test that it works when authenicated by our middleware.

During the lesson, we'll also briefly look at a strategy to keep your credentials out of source control using a .gitignore file. 

Get a JWT From Auth0 in Express to Be Used in Authentication

Sending a JSON Web Token is one way to valid your identity as a user of an API or service. In this lesson, we will see how to add an Express middleware which will check for a valid JWT and return a 401 Unauthorized error if not.

Add Middleware to Validate a JSON Web Token (JWT)

One way to secure API routes is by using JSON Web Tokens (JWTs) which are passed with each request and checked before a lesson is returned. To do this, you need an OAuth server to provide the signing and authentication of these tokens. Auth0 provides this for free for up to 7,000 users. 

In this lesson, we'll configure Auth0 and gather the details we need to be able to secure our API routes.

Configure an Auth0 API Authentication to Use with Your Server

In this lesson, we'll look at how to handle errors in syncronous and asyncronous request handler functions. 

We'll also look at custom error middleware that allows for better control over how we return errors to our client based on whether we are in a production or development environment.

Handle Syncronous and Asyncronous Errors in Express

Express provides a straightforward workflow to add functionality between the request and the response.

In this space your application can check the request, query other APIs and build up the response in parts before sending the final response.

In this lesson, we'll add an authenication middleware that will check for a specific header and confirm that it has the correct value. If either of these tests fail then the middleware will send an early response with a 401 status.

Create Custom Middleware for Authentication in Express

By default, Express doesn't parse JSON passed in the request body. In fact, the request body is seen as null by Express.

We need to add middleware to allow Express to be able to access the information passed in. In the past, we've had to lean on other libraries such as body-parser. As of version 4.17, Express now comes bundled with it's own JSON middleware.

We will use that middleware in this lesson, build some logic and send a response back to our client.

Parse and Process JSON with Express

Express is a well-known and supported framework for Node web applications. It provides a lot of excellent functionality to process requests, interact with other APIs, handle authentication and return appropriate requests for any client.

This collection will look at providing an API for a specific application but will explore concepts that will be helpful in building a wide variety of applications.

Building an API with Express

In this lesson we will look at serving static files using the static helper provided by Express.

We'll then use the file system module in Node to read the contents of our static directory, select a random file and send the path back to our client.


Serve a random static file with Express

In this lesson we'll introduce our Catchphrase app and use our Express API to serve the image URL. We'll add our custom client side fetch call and deal with CORS issues created by serving our API and application from different origins.

Return JSON from Express and Handle CORS Errors 

In this lesson, we set-up an Express application and have it send a test response. We then test that the server is working using an API client, in this case Insomnia. We'll also install and setup nodemon so our server will reload every time our files change making development much faster.

Set up Express to Automatically Reload on Save with nodemon

Learn how to build a simple REST API to store notes using the latest built-in node features including native ES modules, the fs/promises API, async/await, the nullish coalescing operator, and destructuring. No compilers, no build steps, pure code.

This collection of lessons is great for beginners to Express as long as they are familiar with JavaScript and the HTTP protocol. Those more familiar with node and express will appreciate a fast-paced, modern take on using these popular tools and will likely benefit most from the lessons on input validation, models (which emphasizes a lot of new syntax), using fs/promises to serialize a `Map`, and accessing asynchronous data with `async/await`.

Pre-requisites:

- [Install curl](https://curl.haxx.se/)
- [Install node 14](http://nodejs.org/)
- Be familiar with the terminal

View the source for this project in the [project's github repo](https://github.com/xjamundx/egghead-express).

**Notes**:

- I'm not very pedantic about REST and basically just mean an API over HTTP
- [Express 5](https://expressjs.com/en/guide/migrating-5.html) is still in alpha (and has been for over two years), but most of these lessons apply to Express 4 as long you use something like [express-async-errors](https://www.npmjs.com/package/express-async-errors) to add support for `async` routes and middleware

Build a REST API with Express 5 and node 14

This lesson will rely on the built-in support for async functions found in Express 5 to demonstrate how an API can easily work with data asynchronously. By the end of the lesson our API will have the ability to save its notes to disk as they're added and read them when the server starts up again.

First we'll update our Note model to persist data to the filesystem using the `MapStore` class created in a previous lesson. Then we'll access those updated methods on the Note model using the `await` keyword in our routes. We'll also briefly discuss the importance of catching errors that come from promises and async functions.

**Resources**

- To learn more about `async/await` read [Getting started with async/await](https://www.freecodecamp.org/news/getting-started-with-async-await-b66385983875/).
- You can learn a great deal more about error handling in express in their guide to [error handling in express](http://expressjs.com/en/guide/error-handling.html).

Access Asynchronous Data in an Express API with async/await

We have an API that allows us to return a list of notes at `/notes`. We want to add the ability to sort that list by passing in the `sort` query param, which we read off of `req.query`. Once we know the expected sort order we pass a function to `Array.prototype.sort` that compares two notes' `lastEdited` values to decide which item comes first.

A quick refresher about how [custom Array sort functions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort) work in JavaScript. Sort takes a function with two params (which are items in the array). If the function returns true, the `a` item will be placed higher in the sorted array. If the function returns `false`, the `b` item will be placed higher.

View the source for this project on the [projects github repo](https://github.com/xjamundx/egghead-express/).

Sort and Return an Array of Objects with a Query Param in an Express API

We'll create a `new Map()` data structure to store Notes that are passed into our API in memory. With that in place we'll create a model called `Note.js` that has the responsibility for saving and manipulating those notes and saving them back into our data store. After we hook up the our routes to call into our Note model and confirm that it all works.

To power our API we use some modern JavaScript syntax:

- [nullish coalescing operator](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_coalescing_operator)
- [Map.prototype.values](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map/values)
- [array and object spread](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_syntax)
- [Array.from](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/from)




Create a Model to Manage Data for an Express API

Whenever you're designing an API that receives input, there's a chance people are going to use it maliciously or incorrectly.

This lesson will look at some common problems that can occur when we assume input exists that doesn't and how to pro-actively handle it by sending status code `400 Bad Request` with custom response messages. A popular library for input validation is [Joi](https://github.com/hapijs/joi).

A few notes:

- Always assume query params and post bodies are `undefined`
- Set defaults or check that they exist
- When required values aren't found send a `400` status code and appropriate message
- When you use `urlencoded({ extended: true })` with express it tries to parse numbers and booleans into those primitives instead of strings, so be ready for that.
- Always validate each value that is sent as input into your API, don't assume it's safe to use it without checking (see below for an example).

---

One simple strategy for validating input is to put the correct values in an Array or Set:

```
const { sort = "desc" } = req.query;
const validSorts = new Set(["desc", "asc"]);
if (!validSorts.has(sort)) {
    return res.status(400).send("Invalid Sort Param");
}
```

---

One of the worst things you can do in your express app is forget to `return` when you call `res.send()`. It leads to this dreaded `Error: Can't set headers after they are sent to the client` error which can be very hard to trace.


---

Another important concept is to never ever ever blindly pass in the results of `req.query` or `req.body` to some other object. It's potentially a massive security vulnerability. Imagine a scenario like this:

** DO THIS **
```
const { squareFootage, numRooms} = req.body
const house = new House({ squareFootage, numRooms})
```

**DO NOT DO THIS**
```
const body = req.body // someone could pass in price: 0
const house = new House(body) // free house for me!!
```



Validating Input to an Express API

When we import assets in React components outside of the `public` folder that Nitro reads for assets by default when running the development server we need to tell Nitro how to find them with the `devProxy` configuration option.

```typescript
export default defineNitroConfig({
  renderer: './renderer.ts',
  devProxy: {
    '/app/assets': 'http://localhost:5173/app/assets'
  }
})
```

This is ultimately inadequate in scenarios where you want to import assets arbitrarily and have them "just work" but works in a pinch.



Use devProxy in Nitro Config to Serve Static Imported Assets in Dev Mode via Vite

Learn how to use devProxy in Nitro Config with Vite to serve static assets in React components in dev mode.

Start with a basic Vite React TypeScript app and enhance it for production use by integrating Nitro as the server. 

This requires a custom Vite plugin for nitro as well as a custom renderer and manually creating Nitro config.

The other way to approach this would be to add Vite to a Nitro app instead. Same basic result.

The [Nitro config reference](https://nitro.unjs.io/config) is a great read of you'd like to explore more options.


Configure a Vite React TypeScript Application on a Basic Nitro Server

Configure a Vite React TypeScript app by integrating Nitro for production, using custom plugins, renderers, and configs.

Quick Get Started style introduction to Vite using `pnpm create vite` with the React TypeScript template.

See [more in the official docs](https://vite.dev/guide/).

Create a Vite App with the React TypeScript Preset

Quick guide to start a Vite app using React TypeScript template with pnpm.

Over the years, your application have grown huge. Sometimes, really HUGE.

Many developers have contributed to the codebase. One day they pushed one coding style, a different one another day. Sometimes even different patterns and solutions for similar problems.

You want to keep your codebase consistent. In the Angular ecosystem, there were well established patterns for doing things the right way ™️. But the old solutions are being challenged by signal-based approach.

Eventually, you ask yourself the key question: **Should you integrate with the NEW solutions or stick to the battle-tested ones, but already considered LEGACY**?

That's a very good question indeed. Don't rush with architectural decisions 🤓.

## 👉 First, think of what problems you want to solve by introducing the change.

Do you have 1k LoC Angular components? Maybe even 2k? Do you and your team enjoy working with these? 😏

Where does the **domain logic and state management code** belong to - do you have a clear guidance on which code should be put where? Have you spot that different devs implement similar features in totally different ways?

Do you keep on asking the same questions over and over again: **whether this certain piece of code** should be **imperative** (plain old object properties and variables) or **reactive** (streams)? It'd be nice to keep all thinga reactive, but more often than not, it introduces complexity.

## 👉 Second, think of long-term consequences.

You are going to have more than one way to **manage the state**. But is that really an issue? If your codebase is modular, separate modules should not depend on each other in any way. Inner abstractions of one should be invisible to the other, etc.

You are going to introduce a **new tool**. On one hand, you need to learn it, and so does your team. But on the other hand, it's a breathe of fresh air. And it's useful to question the way you've been doing things so far. Maybe there's a more effective way?

You are going to embrace signal-based APIs. And that means taking taking advantage of Zoneless Angular. This means using all modern Angular APIs. And you know that signals are the future. Why would you want to stick to the **less performant, less type-safe, less flexible and, objectively, less effective solutions**?

## 👉 Finally, plan your INCREMENTAL integration.

INCREMENTAL is the absolute keyword here. You don't want to tell your PM you need to stop delivering features because of a refactor.

Actually, there's no need for a "refactor". Just pick the first new feature to be implemented. Or pick the one that needs to be extended.

NGRX Signal Store allows you to create both very simple & small stores, as well as bigger ones. **Composition** is the key here.

**Start simple**.

Create a `withState` section with the signals that hold the state. That's already reactive. And relatively simple.

```ts
const initialState: CartState = {
  items: ...,
  rebate: ...,
}

export const CartStore = signalStore(
  withState(initialState)
);
```

Create a `withMethods` section to provide ways to change the state:

```ts
export const CartStore = signalStore(
  ...
  withMethods((store) => ({
    addItem(item: ShoppingItem): void {
      patchState(store, (state) => ({ items: [ ...state.items, item ] }));
    },
    ...
);
```

Create a `withComputed` section to provide all derived computations:

```ts
export const CartStore = signalStore(
  ...
  withComputed(({ items }) => ({
    totalPrice: computed(() => items().reduce(...))
    ...
);
```

**Start simple**.

Now you can (literally) **`inject` this code into your existing solution**. All you need is to inject your brand new NGRX Signal Store implementation into a component, or a service:

```ts
@Injectable()
class ExistingBigService {
  cartStore = inject(CartStore)
  //...  
}
```

and that's it! What's beatiful is that NGRX Signal Store should remain an implementation details (of a component, service, etc). It **shouldn't leak outside to the entire application unintentionally**. Small NGRX Signal Stores help us to **keep logic more modular**.

Don't hesitate - give NGRX Signal Store a try! Start with the [_**Scalable Signals Angular Architecture with NGRX Signal Store**_](https://egghead.io/courses/scalable-signals-angular-architecture-with-ngrx-signal-store-a33abd39) course now!

Integrating NGRX Signal Store with an existing Angular application


Integrate NGRX Signal Store into your Angular app incrementally for modular, reactive state management. Improve consistency and performance with modern APIs.

In React 19, managing script tags efficiently within components can lead to performance enhancements and simpler code structures.

Originally, using script tags directly in a React component involved complex setups, like using `useEffect` to dynamically add JavaScript code. For instance, a component might dynamically inject script tags to load external widgets. This approach, while functional, resulted in multiple script tags and duplicate iframe elements. This duplication not only cluttered the output but also negatively impacted performance by loading scripts multiple times.

The workaround for this would be to manually hoist any common scripts and maybe load them when they weren't needed by any components.

With React 19 we now have a more effective method. This involves directly placing the script tag within the React component's return statement. This approach ensures that React handles the script loading, avoiding the duplication of script tags.

By implementing the script tags this way, the loading initiator becomes React DOM, which efficiently manages script loading and deduplication. This setup prevents multiple requests for the same script when the component is rendered multiple times, enhancing the overall application performance.

Furthermore, directly embedding the script tag simplifies the code, making the component cleaner and more maintainable.

Efficiently Render Script Tags in React 19 Components

Learn how to efficiently render script tags in React 19 components to improve performance by avoiding duplicate script loads and simplifying your code.

Let's learn how to dynamically manage title tags in React 19 applications. Rendering `<title>` dynamically is simple enough, however, a challenge arises when multiple title tags are present in the document, which can lead to issues with screen readers and search engine optimization (SEO). The solution presented involves ensuring that only one title tag is rendered at a time by using conditional rendering.

Also we need to make sure to have a single string within the title tag using a template literal, ensuring our HTML remains valid and optimized.


Deduplicate Title tags with React 19

Learn to manage multiple title tags in React 19 dynamically. Ensure accessibility and SEO by preventing duplicate title tags with clear examples.

In React 19, we can easily add a title tag like "Starship Deets" which then appears in the head section of the HTML even when we render it inside our components. This method also applies to meta tags such as character set and viewport settings, which are also lifted to the head section automatically.

This is an awesome feature because it maintains the same composition style we are familiar with in React components. It simplifies the handling of HTML head elements without needing extra setups like `useEffect` for accessing the head section. Even in situations where our components are rendering within a body element, like within a div, we can manage our head content directly within our components. React takes care of hoisting these elements where they need to go.


Hoist Title and Meta tags in React 19

Hoisting title and meta tags directly in React 19 components allows for simpler composition, similar to other React elements. Manage meta and title tags.

<PodcastLinks />

Dax Raad, known for his strong opinions on Twitter, sat down for a chat about web dev, career moves, and building cool stuff. He's not afraid to throw some heat at popular tools like [Next.js](https://nextjs.org/), though he still helps people use it. Dax is particularly excited about local-first development, which he thinks isn't getting enough attention. He argues that sometimes the best web dev move is to step away from web dev entirely and explore other areas of programming.

When it comes to career growth, Dax encourages developers to think beyond the "web dev" label and see themselves as programmers capable of tackling any challenge. He advocates for trying out weird stuff and learning unusual languages, as these experiences can lead to unexpected opportunities. Taking smart risks in your career can open doors to awesome possibilities.

In the business world, Dax is a fan of making "asymmetric bets" - moves with low downside but huge potential upside. He applies this philosophy to his work on [SST](https://sst.dev/), reasoning that even if it fails, he'll walk away with valuable experience. He also emphasizes the importance of resisting quick payouts in favor of potentially bigger wins down the road.

Looking to the future of tech, Dax is betting on local-first development. He sees potential in getting in early on emerging technologies like [Solid.js](https://www.solidjs.com/). Building in public and making connections in new tech communities can pay off in unexpected ways.

Dax also challenges the notion of constant hyper-productivity in tech. He suggests balancing focused work with time for exploration and learning. Sometimes, he points out, what seems like a "dumb" choice (like learning a niche language) can turn out to be a smart career move in the long run.

## Good Stuff Mentioned

- [Next.js](https://nextjs.org/)
- [Vercel](https://vercel.com/)
- [SST](https://sst.dev/)
- [Elixir](https://elixir-lang.org/)
- [Solid.js](https://www.solidjs.com/)
- [RepliCache](https://replicache.dev/)
- [Linear](https://linear.app/)
- [Remix](https://remix.run/)
- [Shopify](https://www.shopify.com/)
- [React](https://react.dev/)

Developer Career Growth and Asymmetric Bets with Dax Raad

<PodcastLinks />

Dev and Joel discuss React Miami conference, praising its fun atmosphere and location. They chat about React Server Components, with Dev sharing his experience building a mini framework. They talk about Vinxi, Nitro, and the unjs ecosystem as tools for creating custom frameworks. The conversation touches on Vue's popularity outside web dev circles and non-web dev conferences. They discuss the benefits of TypeScript and strongly-typed APIs. Dev mentions his upcoming talk on durable objects at [a conference in Dallas](https://x.com/DThompsonDev/status/1829674506237194456). They end by discussing WebSockets, PartyKit, and platform-specific frameworks.

## What's Good?

- [React Miami Conference](https://www.reactmiami.com/) 
- [Brenley Dueck's blog post on Simple RSC with Vinxi:](https://www.brenelz.com/posts/simple-rsc-with-vinxi/)
- [Vinxi](https://github.com/nksaraf/vinxi)
- [Nitro](https://nitro.unjs.io/guide/configuration)
- [unjs ecosystem](https://unjs.io/)
- [Solid Start](https://start.solidjs.com/)
- [TanStack Router](https://tanstack.com/router/latest) 
- [PartyKit](https://github.com/partykit/partykit) 
- [Durable Objects (Cloudflare)](https://developers.cloudflare.com/durable-objects/)
- [Flightcontrol](https://www.flightcontrol.dev/) 
- [SST](https://sst.dev/)
- [OpenNext](https://open-next.js.org/)

Nitro, Vinxi, and RSCs - What's Good with Dev Agrawal

**Note:** This course is being actively developed and more lessons will be added in the future.

Cursor is an AI-enhnaced code editor that allows you to call upon the robots to refactor or stub out functions for you with natural language. 

In this course, John will show you workflows that will save you time and effort by utilizing the features such as its mult-line editing and context.

In particular, by giving Cursor's AI the proper context, whether that's lines of code or multiple files, you'll get better output when trying to extend or refactor logic that's present.


Bite-size video tutorials for badass web developers.

Search

Search Results