Every server term

• .env file A file of private settings like keys and passwords that stays out of Git.
• /health route A simple address that answers OK so a host can check the server is alive.
• 200 The status code meaning the request worked and the response holds the result.
• 201 The status code saying a new item was created, usually after a POST request.
• 204 The status code for success with no body to send back, common after a delete.
• 301 A permanent redirect telling the browser a page has moved to a new address for good.
• 302 A temporary redirect sending the browser to another address for now.
• 304 Not Modified Tells the browser its cached copy is still current, so no body is sent again.
• 400 The status code saying the request was badly formed or failed the checks.
• 401 The status code saying you need to log in before you can see this.
• 403 The status code saying you are known but not allowed to do this.
• 404 The status code saying nothing exists at the address that was asked for.
• 429 Too Many Requests The status code a server sends when someone has made too many requests too fast.
• 500 The status code saying something went wrong inside the server itself.
• ? placeholder A marker in SQL that the database fills safely with a value you pass in.
• Access-Control-Allow-Origin A response header naming which other sites may read this response in the browser.
• API A set of addresses a program can call to read or change data, usually in JSON.
• app.get() Tells Express what to send back when a GET request reaches a given path.
• app.listen() Starts the server so it waits for requests on a chosen port.
• app.post() Tells Express how to handle a POST request sent to a given path.
• app.set('trust proxy') Lets Express read the real visitor address when it runs behind a proxy.
• app.use() Adds middleware that runs for every request, or for every path under a prefix.
• better-sqlite3 A Node package that lets your server read and write a SQLite database file.
• brute force Guessing passwords over and over until one works, which rate limits slow down.
• Cache-Control A header telling browsers whether and for how long to keep a saved copy.
• console.log() Prints a message to the server log so you can see what your code is doing.
• Content-Security-Policy A header that limits where a page may load scripts from, which blunts XSS.
• Content-Type A header saying what kind of data the body holds, such as HTML or JSON.
• cookie A small named value the browser stores and sends back with each request to that site.
• cookie-parser A middleware package that reads incoming cookies into req.cookies.
• CORS The rules that decide when a page on one site may read responses from another site.
• crypto.randomBytes() Makes a run of random bytes, used here to create a unique salt per password.
• crypto.randomUUID() Makes a long random id that is very hard to guess, good for session ids.
• crypto.scryptSync() Turns a password and salt into a slow hash so stolen hashes are hard to crack.
• crypto.timingSafeEqual() Compares two secrets in a way that does not leak hints through timing.
• db.prepare() Gets a SQL statement ready so you can run it with values filled in safely.
• DELETE The HTTP method for removing an item from the server.
• dotenv A package that loads the values in a .env file into process.env at startup.
• error-handling middleware Middleware with four inputs that catches errors and sends a proper error page.
• escapeHtml() A helper that turns characters like < and & into safe text before putting them in HTML.
• express() Creates a new Express app, the object you attach routes and middleware to.
• express.json() Middleware that reads a JSON request body and puts the result in req.body.
• express.Router() Makes a small group of routes you can mount under one path prefix.
• express.static() Middleware that serves files from a folder, such as images, CSS and scripts.
• express.urlencoded() Middleware that reads normal HTML form posts into req.body.
• fetch() The browser function a page uses to call your API and get the response.
• GET The HTTP method for reading something without changing anything on the server.
• headers Named lines of extra information sent along with a request or a response.
• httpOnly A cookie option that hides the cookie from page scripts, which protects sessions.
• HTTPS The encrypted form of HTTP, so nobody in between can read or change the traffic.
• JSON A plain text format for data, built from objects, lists, strings and numbers.
• localhost The name for your own computer, used to visit a server while you build it.
• max-age A Cache-Control setting saying how many seconds a saved copy stays fresh.
• maxAge A cookie option saying how many milliseconds the browser should keep the cookie.
• middleware A function that runs between the request arriving and the response going out.
• next() Called inside middleware to hand the request on to the next function in line.
• next(err) Skips ahead to the error-handling middleware with the error you pass in.
• node --watch Runs a Node file and restarts it each time you save a change.
• NODE_ENV A setting that tells your code whether it is running in development or production.
• npm install express Downloads Express into your project and records it in package.json.
• origin The scheme, host and port of a site, such as https://example.com:443.
• password hashing Storing a scrambled form of a password so the real one is never saved.
• PATCH The HTTP method for changing some fields of an existing item.
• port A numbered door on a computer that a server listens on, such as 3000.
• POST The HTTP method for sending new data to the server, such as a form.
• Post/Redirect/Get Redirecting after a form post so a page refresh does not send the form twice.
• preflight An OPTIONS request a browser sends first to ask if a cross-site request is allowed.
• process manager A tool that keeps your server running and restarts it if it crashes.
• process.env An object holding the environment settings the server was started with.
• process.env.PORT The port number a host hands your server, read from the environment.
• PUT The HTTP method for replacing a whole item with the new version you send.
• query string The part of an address after the ?, holding name and value pairs.
• rate limit A cap on how many requests one visitor may make within a period of time.
• req.body The data sent in the body of a request, once a body parser has read it.
• req.cookies An object of the cookies the browser sent, filled in by cookie-parser.
• req.get() Reads one request header by name, such as the User-Agent.
• req.ip The address of the visitor who made the request, used for rate limits.
• req.params An object of the named pieces in a route path, such as the :id value.
• req.query An object of the name and value pairs from the query string.
• req.user The logged-in person, attached to the request by your login middleware.
• request The message a browser or program sends to ask a server for something.
• require() Loads a package or another file into your Node code so you can use it.
• res.clearCookie() Tells the browser to delete a cookie, used when someone logs out.
• res.cookie() Sends a Set-Cookie header so the browser stores a named cookie.
• res.json() Sends a value back as JSON and sets the right Content-Type for you.
• res.redirect() Sends the browser to a different address, with a 302 status by default.
• res.send() Sends a response body, such as text or HTML, and ends the response.
• res.set() Sets a response header by name before the response is sent.
• res.status() Sets the status code of the response, such as 404 or 201.
• response The message a server sends back, made of a status, headers and a body.
• response.ok True in the browser when a fetch got a status in the 200 range.
• REST A way of designing an API around nouns, using methods to read and change them.
• Retry-After A header telling the client how many seconds to wait before trying again.
• reverse proxy A server in front of yours that passes requests on and often handles HTTPS.
• route order Express checks routes from top to bottom and uses the first one that matches.
• route parameter A named slot in a route path, such as :id, that matches any value there.
• salt Random data mixed into each password before hashing so equal passwords differ.
• sameSite A cookie option that limits sending the cookie on requests from other sites.
• secure A cookie option that only sends the cookie over HTTPS connections.
• server A program that waits for requests and sends back responses.
• session Server-side memory of who a visitor is, linked to them by a cookie id.
• session id The random value stored in a cookie that points to a visitor's session.
• Set-Cookie A response header that asks the browser to store a cookie.
• SQL injection An attack where typed text gets run as SQL because it was glued into a query.
• SQLite A small database that lives in a single file next to your server.
• stack trace The list of function calls that led to an error, shown with file and line.
• status code A three-digit number at the start of a response saying how the request went.
• validation Checking that what people send is present, the right type and allowed.
• X-Powered-By A header Express adds that names the framework, best turned off in production.
• XSS Cross-site scripting, when visitor text is shown as HTML and runs as script.