Backend Developer roadmap

What you will learn

1. 1. DNS & HTTP

   How names resolve to addresses and how HTTP and HTTPS carry the web.

   • DNS — Computer Networking · DNS
   • HTTP & HTTPS — Computer Networking · HTTP & HTTPS

2. 2. HTTP & APIs

   Build REST APIs over HTTP and design them well: resources, status codes, pagination and versioning.

   • HTTP & REST — Backend Engineering · HTTP & REST
   • API Design, Pagination & Versioning — Backend Engineering · API Design, Pagination & Versioning

3. 3. SQL Foundations

   Query relational data with SELECT, filtering, sorting and joins.

   • SQL Basics — Databases · SQL Basics
   • Joins — Databases · Joins

4. 4. Security Foundations

   The two most exploited web weaknesses: injection and broken access control.

   • SQL, Command Injection & Path Traversal — Security · SQL, Command Injection & Path Traversal
   • Authorization, RBAC & ABAC — Security · Authorization, RBAC & ABAC

5. 5. Testing Essentials

   Unit tests with Arrange-Act-Assert, then integration and end-to-end tests.

   • Unit Testing & AAA — Testing & Quality · Unit Testing & AAA
   • Integration & E2E Testing — Testing & Quality · Integration & E2E Testing

6. 6. SQL for Applications

   Keep application data correct with transactions, ACID, isolation levels, locking and MVCC.

   • Transactions & ACID — Databases · Transactions & ACID
   • Isolation, Locking & MVCC — Databases · Isolation, Locking & MVCC

7. 7. Authentication Fundamentals

   How web apps keep users signed in with sessions, cookies and tokens, and how XSS and CSRF attacks abuse them.

   • Sessions, Cookies, OAuth & JWT — Backend Engineering · Sessions, Cookies, OAuth & JWT
   • XSS & CSRF — Security · XSS & CSRF

8. 8. Webhooks, Real-Time & gRPC

   Integration styles beyond request/response: webhooks, WebSockets and SSE, and gRPC.

   • Webhooks — Backend Engineering · Webhooks
   • WebSockets & SSE — Backend Engineering · WebSockets & SSE
   • gRPC — Backend Engineering · gRPC

9. 9. Caching & Queues

   Speed up services with caching and idempotent APIs, and move slow work to background jobs and queues.

   • Caching & Idempotent APIs — Backend Engineering · Caching & Idempotent APIs
   • Background Jobs, Workers & Queues — Backend Engineering · Background Jobs, Workers & Queues

10. 10. Observability Essentials

    Structured logging and distributed tracing with OpenTelemetry.

    • Structured Logging — Observability · Structured Logging
    • Distributed Tracing & OpenTelemetry — Observability · Distributed Tracing & OpenTelemetry

11. 11. Dockerfile & Compose

    Write efficient multi-stage Dockerfiles and run multi-container apps with Docker Compose.

    • Dockerfile & Multi-Stage Builds — Docker · Dockerfile & Multi-Stage Builds
    • Docker Compose — Docker · Docker Compose

12. 12. AI-Assisted DevelopmentOptional

    Work effectively with coding agents: give them context and instruction files, prompt for code, connect tools with MCP and review what they produce.

    • Coding Agents — AI-Assisted Development · Coding Agents
    • Context & Instruction Files — AI-Assisted Development · Context & Instruction Files
    • Prompting for Code — AI-Assisted Development · Prompting for Code
    • Tools & MCP — AI-Assisted Development · Tools & MCP
    • Reviewing & Testing AI-Generated Code — AI-Assisted Development · Reviewing & Testing AI-Generated Code

13. 13. SQL Performance

    Read query plans, choose the right indexes and fix N+1 queries and connection pool problems.

    • Indexes & Query Plans — Databases · Indexes & Query Plans
    • N+1, Indexes & Connection Pooling — Performance Engineering · N+1, Indexes & Connection Pooling

14. 14. API Security Best PracticesOptional

    Use the OWASP API Security Top 10 to secure authentication and tokens, enforce object- and function-level authorization, and validate input against mass assignment.

    • OWASP API Security Top 10 — API Security · OWASP API Security Top 10
    • API Authentication & Tokens — API Security · API Authentication & Tokens
    • BOLA & BFLA (Authorization) — API Security · BOLA & BFLA (Authorization)
    • Input Validation & Mass Assignment — API Security · Input Validation & Mass Assignment

15. 15. API Hardening & MonitoringOptional

    Limit abuse with rate limits, lock down transport, CORS and secrets, and log and monitor APIs to detect attacks.

    • Rate Limiting & Abuse — API Security · Rate Limiting & Abuse
    • TLS, CORS & Secrets — API Security · TLS, CORS & Secrets
    • API Logging & Monitoring — API Security · API Logging & Monitoring

16. 16. Backend Performance Best PracticesOptional

    Budget latency on hot paths, access data efficiently at scale, cache with a clear invalidation strategy, apply backpressure and trim payloads and round trips.

    • API Latency Budgets & Hot Paths — Performance Engineering · API Latency Budgets & Hot Paths
    • Data Access Patterns at Scale — Performance Engineering · Data Access Patterns at Scale
    • Caching Strategy & Invalidation — Performance Engineering · Caching Strategy & Invalidation
    • Async I/O, Concurrency & Backpressure — Performance Engineering · Async I/O, Concurrency & Backpressure
    • Payloads, Compression & Network Round Trips — Performance Engineering · Payloads, Compression & Network Round Trips