THE FUTURE MARKETACADEMY
Your classroomRoom 07 · Tech Lab
School of Data & Tech

Full-Stack Basics: servers, databases and deployment

Step 7 of 8 in Tech Lab

Next in your path: 7.9.3 Cloud Architecture: reliable, secure design

What you'll be able to do
  • Explain how a browser, a server and a database work together, and trace one request from click to database and back.
  • Build a JSON API with Node.js that checks its input, limits request size and returns the right status codes.
  • Store data in a SQL database with prepared statements, so user text can never change your SQL.
  • Add sign-up and login with properly hashed passwords and fair, generic error messages.
  • Keep people logged in with secure session cookies, and make sure each person can only see and change their own data.
  • Write automated tests for the happy path and the edge cases, and run them with one command.
  • Deploy the app with settings in environment variables, and explain the limits of a free host.

All the code in this course was tested with Node.js 22 on a computer: the automated tests in Lesson 6 passed (9 of 9), and the server was started and called for real. The app uses only modules built into Node.js, so there is nothing extra to install. You need a computer, a code editor, a terminal, Node.js 22.13 or newer, a GitHub account and an internet connection. This course teaches you to protect your own app (defence only).

Words in this course 61Open the Vocabulary Hall
01

How a full-stack app fits together

In simple words

A restaurant has three parts. The dining room is the front end: what guests see. The kitchen is the server: it takes orders and cooks. The pantry is the database: where the food is stored. A guest never walks into the pantry. They ask the waiter, the kitchen gets what is needed, and a plate comes back.

Before this course: Front-End Development: responsive layouts and JavaScript apps (course 7.7.2). You should already be able to build a responsive page, write JavaScript that renders data, call an API with fetch, handle loading and error states, and publish a static site. Until now, someone else's server answered your fetch. In this course you build that server yourself, plus a database and a login. Our project is "Study Notes": people sign up, log in and keep private notes.

Key facts
  • Front end = HTML, CSS and JavaScript running in the browser. Back end = code running on a server. Database = where data is kept safely between visits. "Full stack" means you can work on all three.
  • The browser and server talk with HTTP. The browser sends a request (a method such as GET or POST, a path such as /api/notes, headers and sometimes a body). The server sends back a response (a status code, headers and a body).
  • Node.js runs JavaScript outside the browser. Its built-in node:http module can create a web server with no extra packages.
  • A server listens on a port. On your own computer, localhost:3000 means "this computer, port 3000".
  • An API that answers in JSON lets any front end (a web page, a phone app, a test script) use the same server.
  • Node.js 22.13 and newer include node:sqlite, a built-in SQLite database. The Node.js documentation still marks it as experimental in those versions, so Node prints an "ExperimentalWarning" when you use it. That is expected in this course.
  • Never trust the browser. Anyone can send any request to your server with tools other than your page. All checks that matter (input rules, who owns what) must run on the server.
Example (your first server, tested)
const http = require("node:http");

const server = http.createServer(function (req, res) {
 if (req.method === "GET" && req.url === "/health") {
  res.writeHead(200, { "Content-Type": "application/json" });
  res.end(JSON.stringify({ ok: true }));
  return;
 }
 res.writeHead(404, { "Content-Type": "application/json" });
 res.end(JSON.stringify({ error: "Not found" }));
});

server.listen(3000, function () {
 console.log("Open http://localhost:3000/health");
});

Test result: GET /health answered 200 with {"ok":true}; any other path answered 404 with {"error":"Not found"}.

Step by step
  1. Install Node.js from nodejs.org (choose the LTS version), then type node --version in a terminal. You need 22.13 or newer.
  2. Create a folder study-notes and open it in your code editor and in the terminal.
  3. Create hello.js and paste the example code.
  4. Run node hello.js. You should see "Open localhost:3000/health".
  5. Open that address in your browser. You should see {"ok":true}.
  6. Try localhost:3000/anything. You should get the "Not found" answer.
  7. Stop the server with Ctrl+C in the terminal.
  8. Check: in DevTools, Network tab, the /health request shows status 200 and the other shows 404 (names can differ by version).
Watch on YouTube
How to create a simple HTTP server in Node.jsProgrammingKnowledge · YouTube · youtube.com

Videos by other creators on YouTube, for reference. They are not made by or affiliated with The Future Market.

LESSON 01How a full-stack app fits together
LESSON 01 / ANIMATED LESSON / AI VOICE00:00 / 01:00
Read the video script
[Host] "Front end is the dining room. The server is the kitchen. The database is the pantry."
[Screen: browser sends GET /health, server replies 200 with JSON] "The browser sends a request. The server sends a response with a status code and a body."
[Screen: hello.js running in a terminal] "Ten lines of Node.js and you have your own server on localhost."
[Text on screen: Never trust the browser] "One rule for the whole course: the server checks everything, because anyone can send it a request."
Try it now

Run the first server. Add a second route, GET /time, that answers with the current time as JSON. Then draw the restaurant picture for Study Notes: label the dining room, kitchen and pantry with the real parts (page, Node.js server, SQLite file).

ClaudeStuck? Copy a ready-made prompt for Claude

Copy this, open Claude, paste it, and Claude will walk you through the lesson step by step.

For a grown-up: Claude is for adults (18+). Copy this, paste it into Claude, and use the answer to explain the lesson to your child.

I'm learning "Full-Stack Basics: servers, databases and deployment" on The Future Market. Lesson 1: "How a full-stack app fits together".

What the lesson teaches:
- Front end = HTML, CSS and JavaScript running in the browser. Back end = code running on a server. Database = where data is kept safely between visits. "Full stack" means you can work on all three.
- The browser and server talk with HTTP. The browser sends a request (a method such as GET or POST, a path such as /api/notes, headers and sometimes a body). The server sends back a response (a status code, headers and a body).
- Node.js runs JavaScript outside the browser. Its built-in node:http module can create a web server with no extra packages.
- A server listens on a port. On your own computer,  means "this computer, port 3000".
- An API that answers in JSON lets any front end (a web page, a phone app, a test script) use the same server.
- Node.js 22.13 and newer include node:sqlite, a built-in SQLite database. The Node.js documentation still marks it as experimental in those versions, so Node prints an "ExperimentalWarning" when you use it. That is expected in this course.
- Never trust the browser. Anyone can send any request to your server with tools other than your page. All checks that matter (input rules, who owns what) must run on the server.

The exercise I'm working on:
Run the first server. Add a second route, GET /time, that answers with the current time as JSON. Then draw the restaurant picture for Study Notes: label the dining room, kitchen and pantry with the real parts (page, Node.js server, SQLite file).

I'm stuck. Please:
1. Explain the main idea in plain, simple words with one everyday example.
2. Walk me through the exercise one small step at a time. Ask me what I've done so far before giving the next step.
3. Don't just give me the final answer. Help me do it myself, and check my work when I share it.
I'm a parent helping my child (about 8 years old) with a lesson called "How a full-stack app fits together" from the course "Full-Stack Basics: servers, databases and deployment".

Here's what the lesson says:
A restaurant has three parts. The dining room is the front end: what guests see. The kitchen is the server: it takes orders and cooks. The pantry is the database: where the food is stored. A guest never walks into the pantry. They ask the waiter, the kitchen gets what is needed, and a plate comes back.

The activity:
Run the first server. Add a second route, GET /time, that answers with the current time as JSON. Then draw the restaurant picture for Study Notes: label the dining room, kitchen and pantry with the real parts (page, Node.js server, SQLite file).

Please explain this so an 8-year-old understands: short sentences, a fun everyday example, and no hard words.
Then give me 3 simple questions I can ask my child to check they understood, and a way to do the activity together, one tiny step at a time.
Open Claude
Sources
My notes
02

Build a JSON API

This lesson is part of full access: every course and every level for one payment.

03

Store data in a database

This lesson is part of full access: every course and every level for one payment.

04

Sign-up and login done safely

This lesson is part of full access: every course and every level for one payment.

05

Sessions, cookies and who can see what

This lesson is part of full access: every course and every level for one payment.

06

Test it automatically

This lesson is part of full access: every course and every level for one payment.

07

Deploy it, and know its limits

This lesson is part of full access: every course and every level for one payment.

++

Final project

This lesson is part of full access: every course and every level for one payment.

??

Quiz

  1. In the restaurant picture, what are the front end, the server and the database?

  2. Why must every important check run on the server?

  3. Which status code means "created", and which means "not logged in"?

  4. Why does the app limit the request body size?

  5. What is the main defence against SQL injection?

  6. Why do we hash passwords instead of encrypting them?

  7. What does a salt do?

  8. What should a failed login say?

  9. What does the HttpOnly cookie attribute do?

  10. What must logout do on the server?

  11. Which risk is number 1 in the OWASP Top 10 (2025), and how does the app guard against it?

  12. Why is a SQLite file on a free host with an ephemeral filesystem only good for a demo?

EX

Final exam

This lesson is part of full access: every course and every level for one payment.

CE

Certificate

This lesson is part of full access: every course and every level for one payment.