skills.rest
lunaticwithaduck
lunaticwithaduckCOMMUNITY
Explore all skills by this author →
GitHub

backend

Guides REST API design, authentication, validation, and error handling for Node.js backends.

2|Updated Jun 8, 2026
Search Tags:#jwt#middleware#rest api#trpc#express#fastify#zod validation
One-click install
npx skills add https://github.com/lunaticwithaduck/easytech3d --skill backend-lunaticwithaduck
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend
Source: https://github.com/lunaticwithaduck/easytech3d/tree/main/.claude/skills/backend
Command: npx skills add https://github.com/lunaticwithaduck/easytech3d --skill backend-lunaticwithaduck

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Building secure, well-structured backend APIs requires many decisions—framework choice, auth strategy, validation, error handling—and mistakes like storing JWTs in localStorage or skipping input validation lead to real vulnerabilities. This Skill provides decision trees, patterns, and checklists for Node.js backend development. ## Core Features & Use Cases - Framework Selection: Decision tree and comparison table for Express, Fastify, tRPC, and NestJS based on performance, TypeScript support, and team needs. - Auth & Security Patterns: JWT flow with refresh tokens, OAuth2 authorization code flow, token storage rules, and middleware ordering for security headers, CORS, and rate limiting. - Validation & Error Handling: Zod schema validation middleware, consistent ApiError response shape, and a global error handler pattern. - Use Case: When scaffolding a new Express REST API, use this Skill to set up helmet, CORS, rate limiting, JWT authentication, Zod validation on every endpoint, and a pre-delivery security checklist. ## Quick Start Ask the assistant to design a REST API with Express, JWT authentication, and Zod validation for a users resource.

Frequently Asked Questions about backend

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure a REST API with Express and Zod validation?▼

Define a Zod schema covering body, params, and query, then wrap it in a validation middleware that returns a 400 VALIDATION_ERROR response on failure. Apply the middleware before each route handler and register a global error handler last.

Express vs Fastify vs tRPC: which Node.js framework should I choose?▼

Choose Express for the largest ecosystem and hiring pool, Fastify for 2-3x better performance with built-in schema validation, and tRPC for end-to-end type safety with a TypeScript React frontend. NestJS suits enterprise apps needing decorators and dependency injection.

Where should I store JWT tokens on the client?▼

Store access tokens in JavaScript memory, never in localStorage, which is vulnerable to XSS theft. Store refresh tokens in httpOnly, Secure, SameSite=Strict cookies and use a refresh endpoint to rotate access tokens on 401 responses.

What is the correct middleware order in Express?▼

Order middleware as: security headers (helmet), CORS, body parsing, request logging, rate limiting, authentication, authorization, route handlers, and error handling last. Registering the error handler before routes means errors will not be caught.

When should I use GraphQL instead of REST?▼

Use GraphQL when frontends need flexible data shapes, multiple related resources are fetched together, or real-time subscriptions are required. It is not worth the overhead for simple CRUD APIs with a single frontend and few endpoints.

What are common backend security mistakes to avoid?▼

Common mistakes include storing JWTs in localStorage, skipping input validation, leaking stack traces in production, missing rate limiting, hardcoded secrets, and wildcard CORS origins. The Skill's pre-delivery checklist covers validation, auth, rate limiting, and graceful shutdown.

Related Skills

Explore More Software Engineering Skills→
Montte-erpMontte-erp
6

tanstack-start

Scaffold full-stack React apps with SSR, server functions, and Nitro deployment presets.

Official
Advanced
AradotsoAradotso
11

edgesecurityaccess-wireguard-vpn

Deploy an ESA WireGuard VPN server and provision user configurations via HTTP API.

Official
Intermediate
imaginationeverywhereimaginationeverywhere

database-query-optimization-standard

Batch database queries with DataLoader and optimize Sequelize in GraphQL resolvers.

Official
Advanced
WhaleylawWhaleylaw

connection-pooling-specialist

Diagnose PostgreSQL and Supabase connection exhaustion and configure Supavisor or PgBouncer pooling.

Community
Advanced