Guidelines
Authentication & Authorization
OAuth 2.0: Authorization protocol for third-party access (Google Login,
GitHub Login)
OpenID Connect (OIDC): Identity layer over OAuth 2.0 (used in SSO)
JWT (JSON Web Tokens): Stateless auth used in most MERN apps for secure
APIs
Refresh Tokens: Extend sessions without asking users to re-login
Role-Based Access Control (RBAC): Manage permissions (admin, editor,
viewer)
API Design & Security
RESTful API Design: Good URL structures, HTTP methods (GET, POST, PUT,
DELETE). Resource: [Link]
pragmatic-restful-api
API Testing with Postman: Critical for backend development and debugging
Input Validation & Sanitization: Prevent security issues (like injection attacks)
CORS (Cross-Origin Resource Sharing): Handle frontend-backend
communication securely
Rate Limiting & Throttling (Optional): Protect APIs from abuse
Backend ([Link]/Express)
Middleware in Express: Key to logging, validation, auth, error handling
Custom Error Handling: Maintain cleaner, debuggable backend apps
Environment Variables (.env): Avoid leaking sensitive credentials
File Uploads with Multer: Upload images or files to backend
Guidelines 1
Socket Programming
Frontend-Backend Integration (React ↔ Node)
Axios / Fetch for API Calls: Real-world frontend API interactions
Storing Tokens Securely (localStorage vs httpOnly cookies): Prevent
unauthorized access or data leak.
Protected Routes in React: Hide routes unless user is logged in
State Management (Context API / Redux): Manage auth & user state globally
Additional Bonus
Email Sending: Real-world feature in most apps
Third-party SDKs Integration: Working with APIs and libraries.
Deployment: Vercel or Netlify (free one)
AI Integration (Optional): Free integration with Gemini API
Guidelines 2