Node.js Best Practices

Lesson content

🎯 Goal By the end of this lesson, you'll understand: What are Node.js Best Practices? Why are they important? Project Structure Coding Standards Error Handling Security Performance Logging Environment Variables Interview Questions What are Node.js Best Practices? Best Practices are recommended techniques that help you write: Clean Code Secure Code Fast Applications Maintainable Projects Scalable Applications Simple Definition: Best Practices are proven ways to write better Node.js applications. Why Do We Need Best Practices? Without best practices: Code becomes messy Bugs increase Security risks increase Difficult to maintain Poor performance Real-Life Example 🏗️ Imagine building a house. Without Rules Bricks Anywhere Windows Anywhere Doors Anywhere ↓ Unsafe House With Rules Proper Design Strong Foundation Correct Wiring ↓ Safe House The same applies to Node.js applications. 1. Organize Your Project Properly Bad Structure project/ │ ├── app.js ├── user.js ├── order.js ├── payment.js Good Structure project/ │ ├── src/ │ ├── config/ │ ├── controllers/ │ ├── routes/ │ ├── services/ │ ├── models/ │ ├── middleware/ │ ├── utils/ │ ├── validators/ │ └── app.js │ ├── package.json └── .env 2. Use Environment Variables Don't write secrets inside code. ❌ Bad const JWT_SECRET = "mysecret123" ; ✅ Good require ( "dotenv" ) . config(); const JWT_SECRET = process . env . JWT_SECRET; .env PORT=3000 JWT_SECRET=mysecret123 DB_HOST=localhost 3. Handle Errors Properly ❌ Bad app . get( "/" , ( req , res ) => { throw new Error ( "Server Error" ); }); ✅ Good app . get( "/" , ( req , res , next ) => { try { res . send( "Hello" ); } catch ( err ) { next ( err ); } }); Error Middleware app . use(( err , req , res , next ) => { res . status( 500 ) . json({ message: err . message }); }); 4. Validate User Input Never trust client input. ❌ Bad const age = req . body . age; ✅ Good if ( ! req . body . email) { return res . status( 400 ) . json({ message: "Email Required" }); } Popular libraries: Joi Zod express-validator 5. Use Async/Await ❌ Callback fs . readFile( "file.txt" , ( err , data ) => { }); ✅ Async/Await const data = await fs . promises . readFile( "file.txt" ); 6. Use Proper HTTP Status Codes res . status( 200 ) . json( data ); res . status( 201 ) . json( user ); res . status( 400 ) . json( error ); res . status( 401 ) . json( error ); res . status( 404 ) . json( error ); res . status( 500 ) . json( error ); 7. Use Middleware Instead of repeating code: authenticate ( req ); authorize ( req ); validate ( req ); Use middleware. app . get( "/profile" , authenticate , authorize ( "admin" ), profileController ); 8. Separate Business Logic ❌ Bad app . post( "/users" , ( req , res ) => { // Database logic // Validation // Email // Response }); ✅ Good app . post( "/users" , userController . createUser ); Controller exports . createUser = async ( req , res ) => { }; Service exports . createUser = async () => { }; 9. Use Logging Instead of: console . log(); Use logging libraries. Examples: Winston Pino Morgan (HTTP request logging) Example logger . info( "Server Started" ); 10. Secure Your Application Use: Helmet CORS Rate Limiting HTTPS Strong Password Hashing (bcrypt) Example const helmet = require ( "helmet" ); app . use( helmet ()); 11. Keep Dependencies Updated Update packages regularly. npm update Check vulnerabilities. npm audit Fix automatically where possible. npm audit fix 12. Use a Process Manager Don't run production apps using: node app.js Use: pm2 start app.js Benefits: Auto Restart Monitoring Log Management Zero-Downtime Reloads 13. Graceful Shutdown Close resources before exiting. process . on( "SIGTERM" , () => { console . log( "Shutting down..." ); server . close(() => { console . log( "Server Closed" ); }); }); 14. Avoid Blocking the Event Loop ❌ Bad const data = fs . readFileSync( "file.txt" ); ✅ Good const data = await fs . promises . readFile( "file.txt" ); 15. Write Tests Use testing frameworks like: Jest Mocha Vitest Example test ( "sum" , () => { expect ( 2 + 2 ) . toBe( 4 ); }); 16. Use Version Control Use Git. git init git add . git commit -m "Initial Commit" Benefits: Track changes Collaboration Rollback Branching Request Flow Client │ ▼ Middleware │ ▼ Validation │ ▼ Controller │ ▼ Service │ ▼ Database │ ▼ Response Real-Life Example 🏦 Bank System Customer │ ▼ Security Check │ ▼ Document Verification │ ▼ Manager Approval │ ▼ Transaction Every step follows rules to keep the system safe and reliable. Interview Question Why should we use environment variables? Answer To keep sensitive information like API keys, database credentials, and JWT secrets out of the source code. Why should we avoid synchronous methods? Answer Because they block the Node.js event loop, reducing application performance. Why should business logic be separated? Answer To improve code readability, maintainability, testing, and reusability. Which process manager is commonly used in Node.js? Answer PM2 Name some security middleware. Answer Helmet CORS Rate Limiting Best Practices Checklist ✅ Practice Recommended Use .env ✅ Validate Input ✅ Use Async/Await ✅ Error Middleware ✅ Logging ✅ HTTPS ✅ Helmet ✅ CORS ✅ Rate Limiting ✅ PM2 ✅ Git ✅ Automated Tests ✅ Key Points ✅ Organize your project with a clear folder structure. ✅ Store secrets in environment variables. ✅ Validate all user input. ✅ Use async/await instead of deeply nested callbacks. ✅ Handle errors with centralized error middleware. ✅ Keep controllers thin and business logic in services. ✅ Use logging instead of relying only on console.log() . ✅ Secure your application with Helmet, CORS, HTTPS, and password hashing. ✅ Avoid blocking the event loop with synchronous operations. ✅ Use PM2 and Git in production projects. 🧠 Easy Formula Start Project │ ▼ Good Folder Structure │ ▼ Environment Variables │ ▼ Middleware │ ▼ Validation │ ▼ Controller │ ▼ Service │ ▼ Database │ ▼ Error Handling │ ▼ Logging │ ▼ Response .env = Secrets Middleware = Common Logic Controller = Handle Request Service = Business Logic Database = Store Data PM2 = Production Process Manager Remember: 📁 Organize your project 🔒 Keep secrets in .env ✅ Validate every request ⚡ Use async/await 🛡️ Secure your application 📝 Log important events 🚀 Use PM2 in production 🧪 Write tests for reliable code