Moving Beyond the MERN Stack: My Roadmap to Modern Backend Engineering

Hasnain Jaffer — Sat, 18 Jul 2026 04:05:28 +0000

Like many developers, I started my journey mastering the MERN stack. Building full-stack apps with MongoDB, Express, React, and Node.js was a fantastic foundation—it got me comfortable with JavaScript, API design, and asynchronous logic.

But as I near the final stages of my degree and prepare for my final year project (a university bus tracking system), I’ve realized that "full-stack" is a constantly moving target. To build scalable, production-ready systems, I’m shifting my focus this summer to a more robust backend toolkit.

Here is what I’m tackling in my current roadmap:

Embracing Type Safety with TypeScript
While I loved the flexibility of JavaScript, working on larger projects has shown me the value of static typing. Migrating my logic to TypeScript has already significantly reduced runtime bugs and improved my IDE experience. If you’re still on the fence, the interface and type definitions alone are worth the switch.
High-Performance Backends (FastAPI & Django)
Node.js is great, but for data-heavy applications and AI integrations, I’m exploring Python.

FastAPI has been a game-changer for building high-performance asynchronous APIs.

I’m also digging into Django for projects that require a "batteries-included" approach to rapid development.

PostgreSQL Over NoSQL
While MongoDB served me well for flexible schemas, I’m moving toward PostgreSQL for my upcoming projects. Understanding relational data modeling, complex joins, and ACID compliance is a non-negotiable skill for backend engineers.
Entering the World of AI Agents
Perhaps the most exciting part of my summer study is AI agent orchestration. Learning how to move from simple API calls to building agents that can reason, use tools, and maintain state is the next frontier.

Why the shift?
My goal is to build software that is not only functional but resilient. By combining containerization (Docker/Kubernetes) with a stronger grasp of backend architecture, I want to ensure that the code I write in development performs just as well when it hits production.

I’m currently documenting my progress and sharing snippets of my build process on my [Link to your GitHub/Portfolio].

If you're also transitioning from a JavaScript-heavy background to more diverse backend technologies, let’s connect! What’s one tool you think every modern backend developer should have in their belt?

CORS + Auth Worked Perfectly Locally, Then Broke the Moment I Deployed (Here's Why)

Hasnain Jaffer — Mon, 13 Jul 2026 14:29:58 +0000

I ran into this bug recently and it took me longer to fix than I'd like to admit: my React + Express app worked flawlessly on localhost, but the moment I deployed it, authenticated requests started silently failing. No errors in my own code — just requests that looked like they went out, but the backend never seemed to receive the session/token.
The setup

React frontend and Express backend deployed to separate origins (different domains/subdomains)
Auth relying on a cookie (or JWT sent with credentials) set by the backend
Locally, both ran on localhost with different ports, which browsers treat more leniently

What actually happened
Once frontend and backend were on genuinely different origins in production, a few things I'd gotten away with locally stopped working:

My CORS config allowed origin: '*' — which silently breaks anything using credentials, since browsers won't send cookies/auth headers when the origin is a wildcard.
The cookie itself wasn't configured for cross-site use — no SameSite=None; Secure, which most browsers now require for any cookie sent across origins over HTTPS.
On the frontend, requests weren't explicitly sending credentials (credentials: 'include' in fetch, or withCredentials: true in axios).

Locally, same-origin-ish behavior papered over all three problems at once.
The fix

Set CORS to an explicit origin (not *) and credentials: true on the Express side
Set the cookie with SameSite=None; Secure so browsers allow it cross-site
Explicitly send credentials on every authenticated request from the frontend

Once all three were aligned, everything that had been "randomly failing" in production started working immediately.
Takeaway: if your auth works locally but silently fails after deploy, check CORS origin config, cookie SameSite/Secure attributes, and whether the frontend is actually sending credentials — together, not just one of them.

DEV Community: Hasnain Jaffer

Moving Beyond the MERN Stack: My Roadmap to Modern Backend Engineering

CORS + Auth Worked Perfectly Locally, Then Broke the Moment I Deployed (Here's Why)