DEV Community

Cover image for I Spent 30 Days Building a Complete Node.js Learning Path (Free for Everyone)
Mohin Sheikh
Mohin Sheikh

Posted on Edited on

I Spent 30 Days Building a Complete Node.js Learning Path (Free for Everyone)

#node #backenddevelopment #fullstack #javascript

Most beginner Node.js tutorials show you code that works the first time you run it.

Then you delete a student from your array, add a new one, and suddenly two students have the same id. Or you copy an Express 4 example into an Express 5 project, and the server crashes on startup.

I wanted a course that teaches both: how to build things, and what breaks and why. So I built one: 30 free sessions that take you from your first console.log to a tested, documented REST API with Express and MongoDB.

It is all written (no videos), completely free, with no signup. You can read every session on GitHub.

GitHub logo mohin-sheikh / nodejs-learning-path

A beginner-friendly Node.js learning path covering everything from Node.js fundamentals to building REST APIs. Designed for students with basic JavaScript knowledge and structured as step-by-step practical sessions with examples, exercises, and projects.

Node.js Learning Path

A free, beginner-friendly course that takes you from your first line of Node.js to a complete, tested REST API.

There are 30 short sessions. Each one is a single page you can read right here on GitHub. You learn one idea at a time, run real code, and build up to a final project: a Task Management API with Node.js, Express and MongoDB.

Table of Contents

Who This Course Is For

  • Complete beginners to backend development
  • Frontend developers who want to build their own APIs
  • Students who want a clear, step-by-step path

No backend experience is needed.

What You Need

You need Details
Basic JavaScript Variables, functions, arrays, objects, if and loops
Node.js 24 (LTS)
…
View on GitHub

What's Inside

  • 30 sessions, from "What is Node.js?" to a complete project
  • 700+ code examples, with the real output you should see
  • 290+ animated diagrams that show how things work
  • 200+ practice exercises
  • 370+ interview questions, each with a short answer
  • 1 final project with 31 automated tests

Each session is a single page with a simple explanation, code to type and run, and exercises. Most also have animated diagrams, common beginner mistakes, and interview questions.

The Code Actually Runs

Tutorial code goes out of date fast. The examples in this course were run with current versions (Node.js 24, Express 5 and Mongoose 9) against a real MongoDB database, and the output in each session is the real output.

This matters, because many tutorials still teach Express 4, and a few things changed in Express 5. Even the very first Express server in the course is a little different

const express = require("express");
const app = express();

app.get("/", (req, res) => {
  res.send("Hello from Express");
});

app.listen(3000, (err) => {
  if (err) {
    console.log("Could not start server:", err.message);
    return;
  }

  console.log("Server running on port 3000");
});
Enter fullscreen mode Exit fullscreen mode

In Express 5, if port 3000 is already in use, the callback still runs, with the error inside err. Without the check, your terminal says "Server running" when it is not.

Mistakes Most Tutorials Don't Mention

Most sessions have a "Beginner Mistakes" section. Many of the mistakes come from code that is common online

Common code What really happens Session
newStudent.id = students.length + 1 Two students get the same id after a delete 11
app.all("*", ...) for a 404 page Express 5 crashes at startup 12
express.json() added after your routes req.body is undefined 14
JWT_EXPIRES_IN=3600 in .env Tokens expire after 3.6 seconds, not one hour 22
User.findOne({ email: req.body.email }) A client can send { "$gt": "" } and change your query 22
Changing a password with findByIdAndUpdate The new password is saved as plain text 23
A 100-character password with bcrypt Only the first 72 bytes are used 23

Here is the first one, from Session 11

newStudent.id = students.length + 1;
Enter fullscreen mode Exit fullscreen mode

It looks fine, until you delete someone

Step ids in the array students.length + 1
Start 1, 2, 3 4
DELETE /students/1 2, 3 3
POST a new student 2, 3, 3 Duplicate id 3!

students.length + 1 creates a duplicate id after a delete

The fix is a counter that only goes up

let nextId = 4;

const newStudent = { id: nextId++, ... };
Enter fullscreen mode Exit fullscreen mode

See It, Don't Just Read It

Some ideas are hard to understand from text alone. That is why most sessions include animated diagrams.

The event loop (Session 03)

Event Loop walkthrough: Call Stack, Node.js APIs, Callback Queue

How login with a JWT works (Session 22)

Log in once, receive a token, then send it with every request

The Curriculum

Every session builds on the ones before it.

Part 1: Getting Started

# Session You will learn
01 Introduction to Node.js What Node.js is, installing it, running a file
02 Project Setup and npm package.json, installing packages, npm scripts
03 How Node.js Works The event loop, callbacks, promises, async/await
04 Modules and Imports Splitting code into files

Part 2: Core Modules

# Session You will learn
05 File System Module Reading and writing files, folders and JSON
06 Path Module File paths that work on every computer
07 OS Module System information and the process object
08 Events and EventEmitter Creating and listening to your own events

Part 3: Building Servers

# Session You will learn
09 HTTP Module How the web works, and a server with no framework
10 Building Your First Server Routes, JSON responses and status codes
11 CRUD with Dummy Data Create, read, update and delete data in memory

Part 4: Express.js

# Session You will learn
12 Introduction to Express.js Your first Express 5 server
13 Express Routing URL parameters, query strings and routers
14 Middleware Code that runs before your routes
15 Building REST APIs with Express REST rules, validation and a clean response format
16 Environment Variables Keeping settings and secrets in a .env file

Part 5: Databases

# Session You will learn
17 MongoDB Introduction Documents, collections, Atlas, Compass and mongosh
18 MongoDB CRUD Operations Saving and finding data with the MongoDB driver
19 Mongoose Schemas, models, validation and relationships
20 Express + MongoDB CRUD API A complete API with search, filters and pages
21 MVC Architecture Models, views and controllers

Part 6: Security

# Session You will learn
22 Authentication with JWT Register, log in, protected routes and user roles
23 Password Hashing with bcrypt Storing passwords safely and changing them

Part 7: Production Skills

# Session You will learn
24 Error Handling Catching errors so the server keeps running
25 File Uploads with Multer Uploading and checking files safely
26 Logging Useful logs with winston and morgan
27 API Documentation Interactive docs with Swagger
28 Testing APIs Automated tests with Jest and Supertest
29 Project Structure Best Practices A clean folder layout that grows with your app

Part 8: Final Project

# Session You will learn
30 Mini Project: Task Management API Putting everything together in one real project

The Final Project: A Task Management API

In Session 30 you build the backend of a to-do app, step by step, using everything from Sessions 1 to 29.

Phones and laptops call the Task API, which uses MongoDB, stores pictures, writes logs and shows its docs

Users can register and log in, manage their own tasks, filter them page by page, see statistics (including overdue tasks), upload a profile picture, change their password, and delete their account.

A few of the routes you build

Method URL What it does
POST /api/auth/register Create an account
POST /api/auth/login Log in and get a token
PATCH /api/auth/password Change password
GET /api/tasks List your tasks: ?status=, ?page=
GET /api/tasks/stats Counts per status, and overdue tasks
PATCH /api/users/me/avatar Upload a profile picture
DELETE /api/users/me Delete your account and all its tasks

The project structure

task-management-api/
├── src/
│   ├── config/        settings, database, Swagger
│   ├── controllers/   auth, tasks, users
│   ├── middleware/    login check, uploads, errors, logging
│   ├── models/        User, Task
│   ├── routes/
│   ├── services/
│   ├── utils/
│   └── app.js
├── tests/             31 tests with Jest and Supertest
└── server.js
Enter fullscreen mode Exit fullscreen mode

It also has password hashing, user roles, rate limiting, central error handling, logging with request ids, and interactive API docs at /api-docs.

A Bug the Tests Found

While building the final project, one test failed: "after a password change, the old token stops working". The old token still worked.

The first version used an approach found in many tutorials: save the time of the password change, and refuse tokens created before it. The problem is that a JWT's iat (issued at) only counts whole seconds. A token made in the same second as the change cannot be told apart from a new one.

I measured it, 10 times each

Password changed Old token accepted (time check) With a version number
Right after the token was made 9 of 10 0 of 10
1.1 seconds after 0 of 10 0 of 10

Comparing times in whole seconds lets a token from the same second through; a version number is exact

The fix is simpler and exact. Each user has a tokenVersion that goes up by 1 when the password changes, and every token stores the version it was made with. The login check then refuses old versions

// A token made before the last password change carries an old version number
if (decoded.v !== user.tokenVersion) {
  return res.status(401).json({ success: false, message: "Password was changed. Please log in again." });
}
Enter fullscreen mode Exit fullscreen mode

Session 23 now teaches this fix. And it shows why tests matter: this bug only happens within one second, so you would almost never find it by trying the API by hand.

Practice and Interview Prep

Every session ends with exercises. A few examples

  • Session 11: Delete student 1, then add a new student. Check that the new id is 4, not 3.
  • Session 22: Set JWT_EXPIRES_IN=1m, log in, wait a minute, and call /api/auth/me. Which message do you get?
  • Session 30: Add search, so GET /api/tasks?search=report finds tasks whose title contains the text.

Then come the interview questions, each with a short answer. Try these

Does setTimeout(fn, 0) run immediately? (Session 03)
No. The callback runs only after the current synchronous code finishes and the Call Stack is empty.

Is the JWT payload encrypted? (Session 22)
No. It is only base64url encoded, so anyone can read it. The signature only stops changes, it does not hide data.

Does Express 5 catch errors in async route handlers? (Session 24)
Yes. Express 4 does not, which is why catchAsync wrappers exist.

Does findByIdAndUpdate run validation? (Session 19)
No, not by default. Pass { runValidators: true }.

How to Start

What you need

  • Basic JavaScript: variables, functions, arrays and objects
  • Node.js 24 (LTS) or newer. Session 01 shows how to install it
  • A code editor. VS Code is a good choice
  • From Session 17: MongoDB. A free MongoDB Atlas account works, or a local install

How to learn with it

  1. Open Session 01 on GitHub. You do not need to install anything to read it.
  2. Go in order. Every session builds on the ones before it.
  3. Type the code yourself instead of copying it, run it, and compare your output with the session.
  4. Do the exercises before moving to the next session.

Plan for 1 to 2 hours per session. At one session a day, with time for practice, most learners finish in 4 to 6 weeks.

Want it offline? Clone it

git clone https://github.com/mohin-sheikh/nodejs-learning-path.git
Enter fullscreen mode Exit fullscreen mode

FAQ

Is it really free?
Yes. No signup, no paywall, no email list.

Are there videos?
No. Everything is written, with animated diagrams for the hard parts, so you can learn at your own pace.

Does it use Express 4 or Express 5?
Express 5. Where Express 4 works differently, the course points it out, so older tutorials will still make sense to you.

Can I skip sessions?
It is not recommended. If you already know a topic, read its Beginner Mistakes and try its interview questions. If they are easy, move on.

I found a mistake. What should I do?
Please open an issue on GitHub. Fixes and suggestions are welcome.

Thanks for Reading

If this course helps you, a star on GitHub helps other beginners find it. And if you know someone learning backend development, send it to them.

Top comments (0)