Forem: Wasim Adil

5 Important Things to Secure Your Backend API (for Beginners)

Wasim Adil — Wed, 15 Oct 2025 23:41:18 +0000

If you’re building a backend using Node.js or Express.js, it’s not just about making routes and sending data.
You also need to secure your API — so no one can break it, crash it, or steal your data.

In this post, I’ll explain 5 important things that every beginner backend developer should learn, in a simple and easy way.
Let’s go 👇

🧩 1. Input Validation

What is Input Validation?

Input validation means checking the data before saving or using it.
For example:
If a user enters an email, we should make sure it’s a real email, not something like

DROP DATABASE users;

Types of Validation

✅ Client-Side Validation

Happens in the browser (like in HTML or React).

<input type="email" required />

This helps users fix mistakes early.
But remember — hackers can bypass client validation, so we must always check again on the backend.

✅ Server-Side Validation

Happens before saving or processing data on your server.
We can use libraries like:

Zod
Validator.js
Joi

Example using Joi 👇

import Joi from "joi";

const schema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string().min(6).required(),
});

const { error } = schema.validate(req.body);
if (error) return res.status(400).send("Invalid data!");

Example using Zod 👇

import { email, z } from "zod";

export const CreateUserSchema = z.object({
    username: z.string().min(3).max(20),
    password: z.string(),
    name: z.string(),
    email : z.email(),
    photo : z.string()

})

export const SigninSchema = z.object({
    username: z.string().min(3).max(20),
    password: z.string(),
     email : z.email(),
})

export const CreateRoomSchema = z.object({
    name: z.string().min(3).max(20),
})

If the data is not valid, send a 400 Bad Request.
This helps prevent SQL Injection and other attacks.

💡 Pro tip: Always validate every input before saving to your database.

⚙️ 2. Rate Limiting

What is Rate Limiting?

Rate limiting means controlling how many requests a user or IP can send in a short time.
This protects your API from being overloaded or attacked.

Example:
If your backend can handle 100 requests per second, you can limit each user to 10 per second.

If someone tries to spam or attack your API, rate limiting will automatically block them — and your server won’t crash 💪

How to Do It in Express

Install the package:

npm install express-rate-limit

Then use it:

import rateLimit from "express-rate-limit";

const limiter = rateLimit({
  windowMs: 1000, // 1 second
  max: 10, // limit each IP to 10 requests per second
  message: "Too many requests, please slow down!",
});

app.use(limiter);

💡 Best practice: Always apply rate limiting on login or signup routes — these are most targeted in attacks.

🔐 3. Protect Your APIs (Using Tokens)

Why Use Tokens?

To protect routes, we use authentication.
The most common way is JWT (JSON Web Token).

How JWT Works

When a user logs in → backend creates a token.
The token is sent to frontend and stored (in localStorage or cookies).
On every request → frontend sends the token back.
Backend verifies it before giving access.

Example:

You can also use refresh tokens to get a new token when the old one expires.

💡 Always write authentication logic in middleware so you can use it easily across routes.

🧰 4. Error Handling

Why We Need Error Handling?

Errors will happen — maybe a database issue or a coding bug.
We need to handle them properly so:

The app doesn’t crash
We don’t show private backend details
We can log and fix them later

Example:

// Global error handler
app.use((err, req, res, next) => {
  console.error(err.stack); // log error
  res.status(500).send("Something went wrong!");
});

You can also store errors in files or use tools like ElasticSearch, Sentry, or LogRocket.

💡 Tip: Don’t expose raw errors in production — only send friendly messages to users.

🌐 5. HTTPS

Why HTTPS?

HTTP uses port 80. HTTPS uses port 443.
The “S” stands for Secure — it encrypts data between client and server.

This means even if someone intercepts your traffic, they can’t read the data (like passwords or tokens).

How HTTPS Works

HTTPS uses SSL/TLS certificates for encryption.
You can buy one or get it free from Let’s Encrypt.

Example in Node.js

import https from "https";
import fs from "fs";
import app from "./app.js";

const options = {
  key: fs.readFileSync("key.pem"),
  cert: fs.readFileSync("cert.pem"),
};

https.createServer(options, app).listen(443, () => {
  console.log("Server running on HTTPS");
});

You can also use:

Nginx or Caddy (for auto HTTPS)

Cloudflare as a reverse proxy to add HTTPS for free

💡 Always redirect from HTTP → HTTPS.

Setting Up Prisma + PostgreSQL in a Monorepo (TurboRepo + PNPM + Node.js)

Wasim Adil — Tue, 14 Oct 2025 22:39:37 +0000

In this post, we’ll learn how to set up Prisma with PostgreSQL inside a TurboRepo monorepo, using PNPM workspaces, Node.js, and Docker for the database.

By the end, you’ll have a working Express.js API that connects to a PostgreSQL database via Prisma ORM — all inside a clean, shareable monorepo structure.

What Is a Monorepo?

A monorepo (short for monolithic repository) is a way of organizing multiple apps and packages under one codebase — with shared dependencies, tools, and configs.

For example:

This setup allows all projects to share code easily (like database config or TypeScript settings).

⚙️ Prerequisites

Make sure you have:

Node.js (LTS version)
PNPM (globally installed)

  npm install -g pnpm

Docker + PostgreSQL You can reference this Docker Postgres setup guide to install.

Step 1 : Create the TurboRepo Monorepo

pnpm dlx create-turbo@latest

When prompted:

Select . to create inside your current folder.
Choose PNPM as the package manager.

After setup, you’ll see folders like apps/docs and apps/web.
Delete the docs app — we’ll only keep the web app for now.

Step 2 : Create a Node.js Backend (http-server)

Inside the apps folder, create a new project folder:

cd apps
mkdir http-server
cd http-server
npm init -y

Your package.json should look like this:

{
  "name": "http-server",
  "version": "1.0.0",
  "type": "commonjs",
  "main": "index.js",
  "scripts": {
    "build": "tsc -b",
    "start": "node dist/index.js",
    "dev": "npm run build && npm run start"
  }
}

What These Scripts Do:

build → Compiles TypeScript to JavaScript in the dist folder.
start → Runs the built JS file (dist/index.js).
dev → Builds the code, then starts the server (useful in development).

Step 3 : Create a `tsconfig.json`

Inside apps/http-server, add:

{
  "extends": "@repo/typescript-config/base.json",
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist"
  }
}

👉 This tells TypeScript where to find the source files (src) and where to put compiled files (dist).

Now create:

mkdir src
touch src/index.ts

Step 4 : Add Dependencies

Install dependencies for the backend:

pnpm add express @types/express bcryptjs @types/bcryptjs cors @types/cors

And link the shared TypeScript config from the monorepo:

"dependencies": {
  "@repo/typescript-config": "workspace:*"
}

Then run:

pnpm install

Step 5 : Create a Shared Database Package

In the packages folder, create database:

cd ../../packages
mkdir database
cd database
npm init -y

Update the package.json:

{
  "name": "@repo/database",
  "version": "1.0.0",
  "type": "commonjs",
  "main": "index.js",
  "dependencies": {
    "@repo/typescript-config": "workspace:*"
  }
}

And add a TypeScript config file:

{
  "extends": "@repo/typescript-config/base.json",
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist"
  }
}

Why Create These Files?

package.json: Defines this as a workspace package that other apps (like http-server) can import.
tsconfig.json: Tells TypeScript how to compile code in this package.

Step 6 : Install and Setup Prisma

Inside packages/database:

pnpm add prisma @prisma/client
pnpm prisma init

What These Commands Do:

pnpm add prisma @prisma/client → Installs Prisma ORM and its generated client.
pnpm prisma init → Creates a prisma folder with a schema.prisma file and .env.

Step 7 : Configure Prisma Schema

Open prisma/schema.prisma and replace it with:

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

model User {
  id        String   @id @default(uuid())
  name      String
  email     String   @unique
  password  String
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
}

Step 8 : Setup the Environment Variable

In packages/database/.env, add your PostgreSQL connection string:

DATABASE_URL="postgresql://postgres:postgres@localhost:5432/monorepo-prisma"

Step 9 : Run Prisma Commands

Run the migration and generate the Prisma client:

npx prisma migrate dev --name init_user_model

👉 This creates a migration file in /prisma/migrations and applies it to your PostgreSQL database.

npx prisma studio

👉 Opens Prisma Studio — a beautiful web UI to view and edit your database data.

npx prisma generate

👉 Generates the Prisma client that you’ll use in your code to query the database.

Step 10 : Export the Prisma Client

Inside packages/database/src/index.ts:

import { PrismaClient } from "@prisma/client";

export const prisma = new PrismaClient();

Then update your package.json exports:

{
  "name": "@repo/database",
  "version": "1.0.0",
  "type": "module",
  "main": "index.js",
  "exports": {
    "./config": "./src/index.ts"
  },
  "dependencies": {
    "@prisma/client": "^6.17.1",
    "prisma": "^6.17.1",
    "@repo/typescript-config": "workspace:*"
  }
}

Step 11 : Connect Prisma in the Express Server

Go to your apps/http-server/src/index.ts and paste this:

import express, { Request, Response } from "express";
import { prisma } from "@repo/database/config";
import bcrypt from "bcryptjs";
import cors from "cors";

const app = express();

app.use(express.json());
app.use(cors());

app.post("/api/register", async (req: Request, res: Response) => {
  try {
    const { name, email, password } = req.body;

    if (!name || !email || !password) {
      return res.status(400).json({ error: "All fields are required" });
    }

    const existingUser = await prisma.user.findUnique({ where: { email } });
    if (existingUser) {
      return res.status(409).json({ error: "User already exists" });
    }

    const hashedPassword = await bcrypt.hash(password, 10);

    const user = await prisma.user.create({
      data: { name, email, password: hashedPassword },
      select: { id: true, name: true, email: true },
    });

    res.status(201).json({ message: "User registered successfully", user });
  } catch (error) {
    console.error("Error while registering user:", error);
    res.status(500).json({ error: "Internal server error" });
  }
});

app.listen(3001, () => console.log("🚀 Server is running on port 3001"));

Step 12 : Link Everything Together

Add this to apps/http-server/package.json:

"dependencies": {
  "@repo/database": "workspace:*"
}

Then in the root of your project, run:

pnpm install

Step 13 : Test the API

Run your server:

pnpm dev --filter http-server

Now test the /api/register endpoint using Postman:

POST http://localhost:3001/api/register

Body (JSON):

{
  "name": "Waseem Adil",
  "email": "waseem@gmail.com",
  "password": "12345678"
}

If everything works, you’ll see:

{
  "message": "User registered successfully",
  "user": {
    "id": "uuid-generated",
    "name": "Waseem Adil",
    "email": "waseem@gmail.com"
  }
}

Final Project Structure

Summary

Step	Command / Concept	Explanation
`pnpm dlx create-turbo@latest`	Creates a new monorepo	TurboRepo project setup
`pnpm add prisma @prisma/client`	Installs Prisma ORM	ORM + generated client
`pnpm prisma init`	Initializes Prisma	Creates schema + .env
`npx prisma migrate dev`	Creates migration + syncs DB	Updates schema in Postgres
`npx prisma studio`	Opens Prisma UI	View/Edit database data
`npx prisma generate`	Generates client	Makes PrismaClient usable in code

What Is Prisma?

Prisma is an ORM (Object-Relational Mapper) for Node.js and TypeScript.
It helps you interact with your database (Postgres, MySQL, etc.) using clean TypeScript code instead of writing raw SQL.

Example:

const users = await prisma.user.findMany();

is equivalent to:

SELECT * FROM users;

🎉 That’s It!

Setting Up Prisma + PostgreSQL in a Monorepo (TurboRepo + PNPM + Node.js)

Wasim Adil — Tue, 14 Oct 2025 22:39:37 +0000

In this post, we’ll learn how to set up Prisma with PostgreSQL inside a TurboRepo monorepo, using PNPM workspaces, Node.js, and Docker for the database.

By the end, you’ll have a working Express.js API that connects to a PostgreSQL database via Prisma ORM — all inside a clean, shareable monorepo structure.

What Is a Monorepo?

A monorepo (short for monolithic repository) is a way of organizing multiple apps and packages under one codebase — with shared dependencies, tools, and configs.

For example:

This setup allows all projects to share code easily (like database config or TypeScript settings).

⚙️ Prerequisites

Make sure you have:

Node.js (LTS version)
PNPM (globally installed)

  npm install -g pnpm

Docker + PostgreSQL You can reference this Docker Postgres setup guide to install.

Step 1 : Create the TurboRepo Monorepo

pnpm dlx create-turbo@latest

When prompted:

Select . to create inside your current folder.
Choose PNPM as the package manager.

After setup, you’ll see folders like apps/docs and apps/web.
Delete the docs app — we’ll only keep the web app for now.

Step 2 : Create a Node.js Backend (http-server)

Inside the apps folder, create a new project folder:

cd apps
mkdir http-server
cd http-server
npm init -y

Your package.json should look like this:

{
  "name": "http-server",
  "version": "1.0.0",
  "type": "commonjs",
  "main": "index.js",
  "scripts": {
    "build": "tsc -b",
    "start": "node dist/index.js",
    "dev": "npm run build && npm run start"
  }
}

What These Scripts Do:

build → Compiles TypeScript to JavaScript in the dist folder.
start → Runs the built JS file (dist/index.js).
dev → Builds the code, then starts the server (useful in development).

Step 3 : Create a `tsconfig.json`

Inside apps/http-server, add:

{
  "extends": "@repo/typescript-config/base.json",
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist"
  }
}

👉 This tells TypeScript where to find the source files (src) and where to put compiled files (dist).

Now create:

mkdir src
touch src/index.ts

Step 4 : Add Dependencies

Install dependencies for the backend:

pnpm add express @types/express bcryptjs @types/bcryptjs cors @types/cors

And link the shared TypeScript config from the monorepo:

"dependencies": {
  "@repo/typescript-config": "workspace:*"
}

Then run:

pnpm install

Step 5 : Create a Shared Database Package

In the packages folder, create database:

cd ../../packages
mkdir database
cd database
npm init -y

Update the package.json:

{
  "name": "@repo/database",
  "version": "1.0.0",
  "type": "commonjs",
  "main": "index.js",
  "dependencies": {
    "@repo/typescript-config": "workspace:*"
  }
}

And add a TypeScript config file:

{
  "extends": "@repo/typescript-config/base.json",
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist"
  }
}

Why Create These Files?

package.json: Defines this as a workspace package that other apps (like http-server) can import.
tsconfig.json: Tells TypeScript how to compile code in this package.

Step 6 : Install and Setup Prisma

Inside packages/database:

pnpm add prisma @prisma/client
pnpm prisma init

What These Commands Do:

pnpm add prisma @prisma/client → Installs Prisma ORM and its generated client.
pnpm prisma init → Creates a prisma folder with a schema.prisma file and .env.

Step 7 : Configure Prisma Schema

Open prisma/schema.prisma and replace it with:

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

model User {
  id        String   @id @default(uuid())
  name      String
  email     String   @unique
  password  String
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
}

Step 8 : Setup the Environment Variable

In packages/database/.env, add your PostgreSQL connection string:

DATABASE_URL="postgresql://postgres:postgres@localhost:5432/monorepo-prisma"

Step 9 : Run Prisma Commands

Run the migration and generate the Prisma client:

npx prisma migrate dev --name init_user_model

👉 This creates a migration file in /prisma/migrations and applies it to your PostgreSQL database.

npx prisma studio

👉 Opens Prisma Studio — a beautiful web UI to view and edit your database data.

npx prisma generate

👉 Generates the Prisma client that you’ll use in your code to query the database.

Step 10 : Export the Prisma Client

Inside packages/database/src/index.ts:

import { PrismaClient } from "@prisma/client";

export const prisma = new PrismaClient();

Then update your package.json exports:

{
  "name": "@repo/database",
  "version": "1.0.0",
  "type": "module",
  "main": "index.js",
  "exports": {
    "./config": "./src/index.ts"
  },
  "dependencies": {
    "@prisma/client": "^6.17.1",
    "prisma": "^6.17.1",
    "@repo/typescript-config": "workspace:*"
  }
}

Step 11 : Connect Prisma in the Express Server

Go to your apps/http-server/src/index.ts and paste this:

import express, { Request, Response } from "express";
import { prisma } from "@repo/database/config";
import bcrypt from "bcryptjs";
import cors from "cors";

const app = express();

app.use(express.json());
app.use(cors());

app.post("/api/register", async (req: Request, res: Response) => {
  try {
    const { name, email, password } = req.body;

    if (!name || !email || !password) {
      return res.status(400).json({ error: "All fields are required" });
    }

    const existingUser = await prisma.user.findUnique({ where: { email } });
    if (existingUser) {
      return res.status(409).json({ error: "User already exists" });
    }

    const hashedPassword = await bcrypt.hash(password, 10);

    const user = await prisma.user.create({
      data: { name, email, password: hashedPassword },
      select: { id: true, name: true, email: true },
    });

    res.status(201).json({ message: "User registered successfully", user });
  } catch (error) {
    console.error("Error while registering user:", error);
    res.status(500).json({ error: "Internal server error" });
  }
});

app.listen(3001, () => console.log("🚀 Server is running on port 3001"));

Step 12 : Link Everything Together

Add this to apps/http-server/package.json:

"dependencies": {
  "@repo/database": "workspace:*"
}

Then in the root of your project, run:

pnpm install

Step 13 : Test the API

Run your server:

pnpm dev --filter http-server

Now test the /api/register endpoint using Postman:

POST http://localhost:3001/api/register

Body (JSON):

{
  "name": "Waseem Adil",
  "email": "waseem@gmail.com",
  "password": "12345678"
}

If everything works, you’ll see:

{
  "message": "User registered successfully",
  "user": {
    "id": "uuid-generated",
    "name": "Waseem Adil",
    "email": "waseem@gmail.com"
  }
}

Final Project Structure

Summary

Step	Command / Concept	Explanation
`pnpm dlx create-turbo@latest`	Creates a new monorepo	TurboRepo project setup
`pnpm add prisma @prisma/client`	Installs Prisma ORM	ORM + generated client
`pnpm prisma init`	Initializes Prisma	Creates schema + .env
`npx prisma migrate dev`	Creates migration + syncs DB	Updates schema in Postgres
`npx prisma studio`	Opens Prisma UI	View/Edit database data
`npx prisma generate`	Generates client	Makes PrismaClient usable in code

What Is Prisma?

Example:

const users = await prisma.user.findMany();

is equivalent to:

SELECT * FROM users;

Forem: Wasim Adil

5 Important Things to Secure Your Backend API (for Beginners)

🧩 1. Input Validation

What is Input Validation?

Types of Validation

✅ Client-Side Validation

✅ Server-Side Validation

⚙️ 2. Rate Limiting

What is Rate Limiting?

How to Do It in Express

🔐 3. Protect Your APIs (Using Tokens)

Why Use Tokens?

How JWT Works

🧰 4. Error Handling

Why We Need Error Handling?

Example:

🌐 5. HTTPS

Why HTTPS?

How HTTPS Works

Example in Node.js

Setting Up Prisma + PostgreSQL in a Monorepo (TurboRepo + PNPM + Node.js)

What Is a Monorepo?

⚙️ Prerequisites

Step 1 : Create the TurboRepo Monorepo

Step 2 : Create a Node.js Backend (http-server)

What These Scripts Do:

Step 3 : Create a tsconfig.json

Step 4 : Add Dependencies

Step 5 : Create a Shared Database Package

Why Create These Files?

Step 6 : Install and Setup Prisma

What These Commands Do:

Step 7 : Configure Prisma Schema

Step 8 : Setup the Environment Variable

Step 9 : Run Prisma Commands

Step 10 : Export the Prisma Client

Step 11 : Connect Prisma in the Express Server

Step 12 : Link Everything Together

Step 13 : Test the API

Final Project Structure

Summary

What Is Prisma?

🎉 That’s It!

Setting Up Prisma + PostgreSQL in a Monorepo (TurboRepo + PNPM + Node.js)

What Is a Monorepo?

⚙️ Prerequisites

Step 1 : Create the TurboRepo Monorepo

Step 2 : Create a Node.js Backend (http-server)

What These Scripts Do:

Step 3 : Create a tsconfig.json

Step 4 : Add Dependencies

Step 5 : Create a Shared Database Package

Why Create These Files?

Step 6 : Install and Setup Prisma

What These Commands Do:

Step 7 : Configure Prisma Schema

Step 8 : Setup the Environment Variable

Step 9 : Run Prisma Commands

Step 10 : Export the Prisma Client

Step 11 : Connect Prisma in the Express Server

Step 12 : Link Everything Together

Step 13 : Test the API

Final Project Structure

Summary

What Is Prisma?

🎉 That’s It!

Step 3 : Create a `tsconfig.json`

Step 3 : Create a `tsconfig.json`