About this course
Design and build server-side applications and well-structured APIs that power web and mobile clients, with attention to layered architecture, polyglot data modeling, secure authentication, asynchronous workloads, and production observability.
Course format. Thirteen weeks, four contact hours each: a two-hour lecture (concepts and theory) and a two-hour practice session. The course is project-based; teams carry one running project end to end and present it three times, in weeks 5, 8, and 13.
What you will build
Teams build a complete back-end service for a chosen domain, progressing from a basic CRUD REST API and relational data model to a full platform with GraphQL, secure JWT authentication and RBAC authorization, a Redis caching layer, asynchronous job processing with BullMQ, real-time communication over Socket.io, and demonstrated horizontal-scaling behavior under load.
Expected outcomes
- Design layered back-end systems with clear separation of concerns, applying N-tier architecture and evaluating monolith-versus-microservices trade-offs for a given team and deployment context.
- Build and document APIs using REST resource semantics and HTTP verb contracts with OpenAPI, and GraphQL schema-first design with DataLoader for N+1 prevention; select the right paradigm for each workload.
- Model and query relational and document data using an ORM and migrations, and tune slow queries through index design and EXPLAIN-plan analysis in PostgreSQL.
- Implement JWT-based authentication with OAuth2 Authorization Code + PKCE flow and OIDC claims mapping, and enforce role-based access control in the service layer.
- Design asynchronous workloads with background job queues, deliver real-time events over WebSocket and SSE channels, and manage connection pools and back-pressure under load.
- Instrument services with structured logging, distributed tracing, and RED metrics using OpenTelemetry, and select the appropriate data store (PostgreSQL, MongoDB, Redis) for each feature's access patterns.
Key topics
- REST & GraphQL APIs
- Polyglot persistence
- Authentication & authorization
- Async processing & real-time
- Observability & scaling
Theoretical foundations
The concepts and results this course rests on.
- N-tier and layered architecture: presentation, application, and data layers; separation of concerns (P1)
- Monolith versus microservices trade-offs: deployment complexity, network latency, data isolation, and team topology (P2)
- API design paradigms and contracts: REST resource naming, HTTP verb semantics, versioning, idempotency, and error bodies; GraphQL schema-first design, resolvers, DataLoader for N+1 prevention, and subscriptions for push-based data (P3)
- Polyglot persistence and data-store selection: relational, document, key-value, graph, and time-series stores, and selection criteria for each workload's data shape and access patterns (P4)
- ORM abstraction and the data-access layer: schema migrations, eager vs lazy loading, and the N+1 query problem (P5)
- Database indexing and query planning: B-tree, composite, and covering indexes; EXPLAIN plans and cardinality estimation (P6)
- Business logic, authentication, and domain invariants: input sanitization and error contracts; OAuth2 Authorization Code + PKCE flow, refresh-token rotation, JWKS endpoint verification, and OIDC claims mapping for delegated identity (P7)
- Asynchronous processing and real-time communication: background job queues, workers, retry semantics, idempotent handlers, and dead-letter queues; WebSocket full-duplex protocol (heartbeat, reconnect, presence channels) and SSE for server-push streaming (P8)
- Connection pool management and back-end concurrency: pool sizing, thread vs event-loop models, and back-pressure (P9)
- Back-end observability: structured logging, distributed tracing, RED metrics (rate, error, duration), and alerting (P10)
Prerequisites
This is a Year-3 course. It assumes the mandatory CS core: data structures and algorithms, operating systems, computer networks, databases, software engineering, and the core mathematics (linear algebra, probability and statistics, calculus, discrete mathematics). It additionally requires the specific prior courses listed below.
Course-specific prerequisites:
- Databases
- Computer networks
- Software engineering and a server-side language
Weekly schedule 13 weeks · lecture + practice
Foundations
Wk 1
Service Architecture and Node.js
LectureExamine N-tier and layered architecture, separation of concerns across presentation, application, and data layers, and monolith-versus-microservices trade-offs: deployment complexity, network latency, data isolation, and team topology (P1, P2).
PracticeScaffold the project service with Node.js and Fastify (or Express), implement a health-check endpoint, and wire a basic request-response cycle.
ProjectProject service skeleton running on Node.js with a first routed endpoint is established.
Wk 2
REST Design and API Contracts
LectureCover REST architectural constraints, HTTP verb semantics, resource naming, idempotency, versioning strategies, and error body design; introduce OpenAPI as the contract format for REST APIs (P3).
PracticeDesign the project's RESTful resource model and document it with OpenAPI / Swagger UI, generating an interactive spec from annotated route handlers.
ProjectProject exposes a coherent RESTful resource model documented in an OpenAPI specification.
Data
Wk 3
Relational Data Modeling and ORM
LectureSurvey polyglot persistence and data-store selection criteria; teach relational data modeling, normalization theory, ORM abstraction with Prisma, schema migrations, eager vs lazy loading, and the N+1 query problem (P4, P5).
PracticeDefine the project schema in Prisma, run migrations against PostgreSQL, and wire the data-access layer through the service.
ProjectProject persists data through a normalized PostgreSQL schema managed with Prisma migrations.
Wk 4
Indexing and Query Planning
LectureAnalyze B-tree, composite, and covering indexes; walk through EXPLAIN plan interpretation, cardinality estimation, and a systematic query-tuning workflow in PostgreSQL (P6).
PracticeInstrument slow project queries with EXPLAIN ANALYZE, add targeted indexes, and measure query-time improvement in PostgreSQL.
ProjectProject data layer has documented EXPLAIN plans and appropriate indexes applied to all critical queries.
Wk 5
Specification MilestonePresentation
LectureReview API contract design and data modeling decisions; discuss how data-store selection shapes service architecture.
PracticeTeams present their project specification: domain model, API contract, data schema, tool choices, and scaling goals.
ProjectApproved specification with data model, API contract, and justified tool choices is delivered.
APIs
Wk 6
GraphQL and Apollo Server
LectureExamine GraphQL schema-first design, resolvers, DataLoader for N+1 prevention, and subscriptions for push-based data; compare GraphQL trade-offs against REST for client-driven data fetching (P3).
PracticeAdd an Apollo Server GraphQL layer to the project domain: define the schema, wire resolvers, and implement DataLoader for batched data fetching.
ProjectProject offers a GraphQL interface alongside its REST API, with N+1 prevention via DataLoader.
Wk 7
Document Stores and JWT Authentication
LectureCover MongoDB's document model and query patterns as an alternative persistence layer; examine JWT-based authentication, OAuth2 Authorization Code + PKCE flow, refresh-token rotation, JWKS endpoint verification, and OIDC claims mapping for delegated identity (P4, P7).
PracticeIntegrate MongoDB for a document-shaped feature and implement JWT authentication with token issuance and verification across project routes.
ProjectProject integrates MongoDB for at least one feature and enforces JWT-authenticated access on all protected routes.
Wk 8
Interim Demo MilestonePresentation
LectureReview authentication and RBAC authorization design patterns in preparation for the interim demo and the security phase ahead.
PracticeTeams present a live demo of the working REST and GraphQL API, data layer, and JWT authentication flow.
ProjectWorking REST and GraphQL API with JWT authentication is demonstrated live.
Scale & Observability
Wk 9
Redis Caching, RBAC, and Connection Pool Management
LectureExamine Redis as a key-value store: data structures, caching patterns, invalidation strategies, and consistency trade-offs; cover RBAC enforcement in the service layer; discuss connection pool sizing, thread vs event-loop concurrency models, and back-pressure (P4, P7, P9).
PracticeAdd a Redis caching layer and RBAC middleware to the project service; configure connection pool sizes and verify cache hit rates under load.
ProjectProject serves cached responses from Redis, enforces RBAC on all endpoints, and has tuned connection pool settings.
Wk 10
Async Processing and Real-Time Communication
LectureCover background job queues with BullMQ: workers, retry semantics, idempotent handlers, and dead-letter queues; examine the WebSocket full-duplex protocol (heartbeat, reconnect, presence channels) and SSE for lightweight server-push streaming (P8).
PracticeAdd a BullMQ background job for an async project workload and a Socket.io channel for real-time event delivery to connected clients.
ProjectProject processes at least one workload asynchronously via BullMQ and delivers real-time events over Socket.io.
Wk 11
Back-End Observability
LectureTeach structured logging, distributed tracing, RED metrics (rate, error, duration), and alerting thresholds; explain the OpenTelemetry instrumentation model and how traces, metrics, and logs compose into production observability (P10).
PracticeInstrument the project service with OpenTelemetry: emit structured logs, distributed traces, and RED metrics; verify data in a local collector.
ProjectProject emits structured logs and distributed traces via OpenTelemetry, with RED metrics defined for all critical endpoints.
Wk 12
Horizontal Scaling and Load Testing
LectureCover stateless service design for horizontal scaling, load balancing, event-loop concurrency, back-pressure strategies at scale, and revisit microservices trade-offs in a multi-instance deployment (P2, P9).
PracticeLoad test the project service, identify throughput and latency bottlenecks using observability data, and validate horizontal-scaling behavior under realistic concurrency.
ProjectProject demonstrates measured horizontal-scaling behavior under load, supported by observability evidence.
Capstone
Wk 13
Final Demo and DefensePresentation
LectureSynthesize all course principles: layered architecture, REST and GraphQL API design, polyglot persistence, authentication and RBAC, async processing, observability, and horizontal scaling for production back-end systems.
PracticeTeams present the final demo with an oral defense of all architectural and engineering decisions across the service lifecycle.
ProjectComplete back-end service is delivered with documentation and a defended design across all layers.
AI tools in this course.
Students use AI assistants to generate REST and GraphQL handlers, refactor resolvers, and draft normalized SQL schemas with sensible indexes and migrations. They prompt tools to write contract and integration tests, seed realistic data, and scaffold BullMQ job workers, while connecting agents to database and API MCP servers to inspect query plans and propose tuning. AI helps reason about caching and invalidation strategies, draft JWT and RBAC rules, and generate OpenTelemetry instrumentation boilerplate, which students then probe for authorization gaps and coverage blind spots. Every generated query and auth rule is reviewed, since a plausible-looking AI suggestion can leak data, skip a queue retry, or trigger an N+1 performance cliff.
Student project
Teams build a complete back-end service for a chosen domain, progressing from a basic CRUD REST API and relational data model to a full platform with GraphQL, secure JWT authentication and RBAC authorization, a Redis caching layer, asynchronous job processing, real-time event delivery, and demonstrated horizontal-scaling behavior under load. Each increment is validated with automated and contract tests and presented at one of three milestones.
Requirements
- Build a working system, not a set of disconnected exercises.
- Be original: a new system that solves a real problem, not a re-implementation of a tutorial or course demo.
- Show real depth: real data, real users or realistic load, and engineering trade-offs that are measured rather than assumed.
- Carry one running project from specification to a deployed, defensible result across the whole term.
- Work in a team of three or four and defend the design at each of the three presentations (weeks 5, 8, and 13).
Example projects
Blogging and CMS APIE-commerce catalog and ordersSocial feed backendBooking and scheduling serviceProject management APIInventory and warehouse systemLearning platform backendPayments ledger service
Assessment & grading
Grading is project-based, with no written exam. Teams of three or four present one running project three times.
| Component | What it covers | Weight |
|---|---|---|
| Project · Specification | Presentation 1 (week 5): problem, objectives, and architecture | 20% |
| Project · Interim | Presentation 2 (week 8): the working system demonstrated live | 30% |
| Project · Final | Presentation 3 (week 13): end-to-end demo with oral defense | 50% |
Tools & platforms
- Node.js (Fastify / Express): implement back-end services and HTTP route handlers
- Apollo Server: serve a GraphQL API with schema-first design, resolvers, and DataLoader
- PostgreSQL: store relational data with ACID transactions, indexes, and EXPLAIN-plan analysis
- MongoDB: store document-shaped data for workloads where a flexible schema fits the access pattern
- Redis: cache responses, manage session data, and serve key-value lookups at low latency
- BullMQ: run background jobs with retry semantics, idempotent handlers, and dead-letter queues
- Prisma: model the database schema, manage migrations, and query the data-access layer
- OpenAPI / Swagger UI: document and validate REST contracts with an interactive specification
- Socket.io: deliver real-time events to clients over WebSocket connections with heartbeat and reconnect
- OpenTelemetry: instrument services with structured logs, distributed traces, and RED metrics
Free online courses
Existing free, video-based courses this course can build on, for self-study or as a teaching basis.
- YouTubeNode.js and Express Back End Development (8-Hour Course)
- UniversityFull Stack Open: Deep Dive Into Modern Web Development
In Hebrew · בעברית
Primary literature
Seminal works for advanced study.
- PaperArchitectural Styles and the Design of Network-based Software Architectures
- PaperA Relational Model of Data for Large Shared Data Banks
- PaperRFC 9110: HTTP Semantics
- PaperRFC 6749: The OAuth 2.0 Authorization Framework
- PaperRFC 7519: JSON Web Token (JWT)
- PaperDynamo: Amazon's Highly Available Key-value Store
References
Books and resources link to an online or publisher page.
- TextbookRESTful Web APIs: Services for a Changing World
- TextbookLearning GraphQL: Declarative Data Fetching for Modern Web Apps
- TextbookDesigning Data-Intensive Applications
- TextbookDatabase System Concepts, 7th Edition
- DocumentationOpenID Connect Core 1.0
- DocumentationGraphQL Documentation (Learn)
- DocumentationPostgreSQL Documentation
- DocumentationRedis Documentation
Role in each concentration
| Concentration | Role |
|---|---|
| Intelligent Software Systems | Core · Semester 2 |
| Networking & Cyber Security | Elective |
| AI & Robotics | Elective |
| AI and Quantum Computing for Finance | Elective |
| Immersive Systems & Game Development | Elective |
| Defense Technologies & Autonomous Systems | Elective |