Full Stack Open
by Matti Luukkainen · University of Helsinki
University of Helsinki's 13-part course covering Node/Express REST APIs, MongoDB, token authentication, automated testing, GraphQL, TypeScript, CI/CD, containers and relational databases with Sequelize. Graduates can build, test and deploy a production-shaped JavaScript backend. Part 3 (Node/Express server), Part 4 (testing plus user administration and token auth) and Part 13 (relational databases, migrations, Sequelize) form a genuinely rigorous backend arc: statelessness, token-based sessions, schema design and migrations, integration testing, then containers and CI/CD.
More resources on Server-Side Programming
Designing Data-Intensive Applications, 2nd Edition
Kleppmann and Riccomini on the tradeoffs behind storage engines, replication, partitioning, transactions, consistency models and stream processing. Backend developers finish able to reason about what happens beneath an ORM call and choose data systems deliberately.
Pilcrow's Auth Book (formerly The Copenhagen Book)
Framework-agnostic reference on web authentication covering server-side session tokens, password hashing, email verification, password reset, OAuth, MFA, WebAuthn and CSRF. Explains why each mechanism exists and how to store and invalidate credentials correctly.
CS50's Web Programming with Python and JavaScript
Harvard's sequel to CS50x, taught by Brian Yu: nine weeks on Django, SQL models and migrations, JavaScript, user interfaces, testing and CI/CD, closing with scalability and security. Students ship several database-backed applications with user accounts.
Server-side website programming (MDN Web Docs)
Mozilla's server-side learning area: a technology-agnostic explanation of what happens between an HTTP request and response, then full build-along tutorials in Django and Express. Readers finish able to model data, route requests, and handle sessions.