Backend Systems
Parts I–IV covered what a digital product looks like and feels like. This Part covers what makes it actually work — the databases, authentication, APIs, and infrastructure running behind every screen described so far. These chapters return to the full Part I/II depth and assume the client–server model established in Chapter 1.3.
Start Part V — 5.1Databases: SQL vs. NoSQL
Every other decision in this Part rests on this one — how the product's data is structured, stored, and queried.
5.2Authentication & Authorization
Two words that sound similar and get confused constantly — and confusing them is how access-control bugs happen.
5.3Sessions, Cookies & Tokens
The mechanics behind how a server remembers you across an inherently stateless protocol.
5.4REST API Design
The contract between a backend and everything that consumes it — a website, a mobile app, or another service.
5.5GraphQL & WebSockets
Two answers to two different limitations of plain REST — over-fetching, and the lack of a persistent connection.
5.6Webhooks & Event-Driven Notifications
How two systems that don't share a database still keep each other informed in real time.
5.7Payments & Billing Systems
The single category of bug in a product where "mostly correct" is not an acceptable outcome.
5.8Email & Transactional Messaging
The most reliable channel a product has for reaching users — and the easiest one to accidentally get marked as spam.
5.9Caching Strategies
The single highest-leverage performance technique available to a backend — and the one Phil Karlton called one of the two hard problems in computer science.
5.10Queues & Background Jobs
The pattern that keeps a user-facing request fast by moving the slow part somewhere else.
5.11File Storage & Uploads
Why almost no product stores uploaded files in its own database or on its own web server.
5.12Search Infrastructure
Why a plain database query stops being enough the moment a search box needs to feel fast and forgiving.
5.13Logging & Monitoring
The difference between finding out about an outage from a monitoring alert versus from an angry customer.
5.14Backend Security Fundamentals
The failure modes that don't announce themselves until a breach has already happened.
5.15Scaling Backend Systems
The Part's closing chapter — what happens when a system that worked fine for a thousand users meets a hundred thousand.