Backend Development

Backend Frameworks Comparison — a sourced, dated comparison of 48 backend frameworks (JVM, .NET, Node.js, Python, PHP, Rust, Swift, Go, Ruby and Elixir) on popularity, growth, talent pool and jobs, ease of use, ecosystem and maturity, productivity, throughput, memory, startup and concurrency model, with charts, one summary table and recommendations by purpose.

Java Reference — the Java language and its standard library: language fundamentals, object-oriented programming, records and sealed classes, pattern matching, generics, the Collections Framework, streams, java.time, I/O and NIO.2, concurrency and virtual threads, the module system, and unit testing with JUnit 5 and Mockito, plus a downloadable cheat sheet.

Python Reference — the Python language and its standard library: language fundamentals, dynamic typing, collections, functions, iterators and generators, modules and packaging, files and context managers, object-oriented Python, dataclasses and enums, decorators and metaclasses, type hints, concurrency and asyncio, virtual environments, and testing with pytest, plus a downloadable cheat sheet.

Python FastAPI — building HTTP APIs with FastAPI on Starlette and Pydantic v2 through one running Bookshelf API: path operations and parameters validated with Annotated, request bodies and response models, errors, streaming (JSON Lines and Server-Sent Events), dependency injection with yield, OAuth2/JWT security with PyJWT and pwdlib, SQLModel and other data stores, settings and lifespan, APIRouter project structure, OpenAPI and Swagger UI, WebSockets, static files and templates, testing with TestClient, and deployment with the fastapi CLI, Docker and Kubernetes, plus a downloadable cheat sheet.

Python Flask — building web applications and JSON APIs with Flask 3.1 on Werkzeug and Jinja through one running Bookshelf application: the application factory and blueprints, routing, requests and responses, templates, sessions and forms, Flask-SQLAlchemy and Flask-Migrate, Flask-Login and JWT authentication, flask-smorest and OpenAPI, caching, Celery jobs, async with gevent and Quart, testing, and deployment behind Gunicorn and nginx, in Docker and on Kubernetes, plus a downloadable cheat sheet.

Python Tornado — the asynchronous Python web framework and networking library through one running Bookshelf Live application: the event loop and coroutines on asyncio, request handlers and routing, templates and UI modules, signed cookies and XSRF protection, WebSockets and server-sent events, AsyncHTTPClient, async database drivers, testing with tornado.testing, and running and deploying, plus a downloadable cheat sheet.

Python Pyramid — the small, configurable WSGI framework through one running Bookshelf Shelves application: the Configurator and two-phase configuration, URL dispatch and traversal, views and renderers, security policies and ACL authorization, CSRF protection, Deform and Colander forms, SQLAlchemy with pyramid_tm, events and tweens, testing with WebTest, and deployment, plus a downloadable cheat sheet.

Django (in Web Development) — the batteries-included Python web framework, including REST APIs with Django REST framework and Django Ninja.

PHP and Laravel (in Web Development) — the full-stack PHP framework, including REST/JSON:API backends with Sanctum and Passport.

TypeScript Reference — TypeScript as the language behind Node.js back ends: the type system, generics, decorators and metadata, modules and tooling, and the strict-mode configuration that NestJS projects rely on, plus a downloadable cheat sheet.

Node.js — the JavaScript runtime behind server-side TypeScript and JavaScript, built on V8 and libuv, through one running Bookshelf scenario: installation and release lines, CommonJS and ES modules, npm, the event loop, timers, events, errors, buffers, the file system, streams and Web Streams, node:sqlite, HTTP, HTTPS and WebSockets, worker_threads, child processes and cluster, the built-in test runner, debugging and profiling, security and the permission model, type stripping, building REST APIs, CLI tools and background jobs, and production concerns such as Docker and single executable applications, plus a downloadable cheat sheet.

Express.js — learning Express 5 and building applications with it, through one running Bookshelf scenario: architecture, versions and support, routing and routers, middleware and body parsing, the application, request and response APIs, static files and template engines, error handling, REST APIs, validation, databases and Mongoose, file uploads, GraphQL, WebSockets and Server-Sent Events, SPAs and server-side rendering, security, sessions and authentication, CORS, testing with supertest, production concerns such as proxies, health checks and containers, and migrating from Express 4, plus a downloadable cheat sheet.

NestJS — building structured Node.js back ends with NestJS 12 on TypeScript through one running Bookshelf service: modules, providers and dependency injection, the request pipeline (middleware, pipes, guards, interceptors and exception filters), configuration, TypeORM, Prisma, Drizzle and Mongoose, caching and queues, authentication and authorization, OpenAPI, code-first GraphQL, WebSockets, microservices and CQRS, resilience, testing with Vitest and Jest, and production concerns such as health checks, observability and deployment, plus a downloadable cheat sheet.

Rust Reference — Rust as a backend language: ownership and borrowing, traits and generics, error handling with Result, thiserror and anyhow, threads, Send/Sync and atomics, async/await and the Tokio runtime, Cargo workspaces, testing and benchmarking, serde, FFI and PyO3 interop, and performance and profiling, plus a downloadable cheat sheet.

Axum — building web services in Rust with axum 0.8 on Tokio, hyper and tower through one running Bookshelf application: routing, handlers and extractors, responses and error handling, state, tower middleware and tower-http, JSON REST APIs with validation and OpenAPI, GraphQL and gRPC, sqlx, SeaORM and Redis, sessions, passwords, JWT, OAuth 2.0 and OpenID Connect, WebSockets and SSE, background jobs, configuration, logging, OpenTelemetry and metrics, testing, performance and deployment, plus a downloadable cheat sheet.

Swift Vapor — building web services and web applications in Swift with Vapor 4.122 on Swift 6 and SwiftNIO through one running Bookshelf application: routing, controllers and middleware, Content and validation, Fluent, SQLKit, MongoDB and Redis, Leaf, sessions, WebSockets and Server-Sent Events, authentication with JWT, OAuth and Sign in with Apple, queues, scheduled jobs, APNs and email, OpenAPI, VaporTesting, logging, tracing, Docker and deployment, with the Swift Reference reachable from it, plus a downloadable cheat sheet.

Hibernate Reference — Hibernate ORM as the Jakarta Persistence provider: entities, associations and inheritance mapping, the persistence context and entity lifecycle, locking, fetching and the N+1 problem, HQL/JPQL and the Criteria API, second-level caching, schema generation, Envers auditing, multitenancy, Hibernate Search (Lucene vs. Elasticsearch backends), Hibernate Reactive and Data Repositories, and Bean Validation with Hibernate Validator, plus a downloadable cheat sheet.

SpringBoot Reference — Spring Data across SQL, MongoDB, Couchbase, and Neo4j, transaction isolation and locking, local and distributed caching, REST and gRPC APIs, Spring Security (annotations, the security context, OAuth2/OIDC authorization server and social login), server-side web UI frameworks, Kafka messaging, scheduling, observability (Micrometer, OpenTelemetry, Prometheus, Grafana), reactive programming with Project Reactor, concurrency alternatives (virtual threads, Kotlin coroutines), resilience (see the Resilience section), developer productivity tools (Lombok, MapStruct), testing (JUnit, Mockito, Testcontainers, JMeter), contract-first API development (OpenAPI, protobuf, AsyncAPI, Avro), Maven quality plugins, hexagonal/DDD architectural patterns, and Java vs. Kotlin guidance, plus a downloadable cheat sheet. For JSF (Jakarta Faces), the component-based Jakarta EE web UI framework, including Spring Boot via JoinFaces, see JSF (JavaServer Faces) in Web Development.

Resilience — resilience with Resilience4j and Bucket4j: making a Spring Boot service that calls other services fault tolerant with Resilience4j (CircuitBreaker, Retry, RateLimiter, Bulkhead and TimeLimiter, fallbacks and composition, Spring Boot configuration, observability, Spring Cloud CircuitBreaker, Gateway and OpenFeign, testing and production tuning), and local and distributed token-bucket rate limiting and API quotas with Bucket4j (Redis, JDBC and cache-grid backends, Spring Boot integration with or without the community starter, Spring Cloud Gateway), with a comparison of the two, plus two downloadable cheat sheets.

GraphQL Reference — GraphQL as a query language and runtime: the schema and type system, execution and resolvers, pagination, security and demand control, and federation, with dedicated Spring for GraphQL (Java) and Strawberry/Ariadne (Python/FastAPI) integration coverage plus configuring Apollo Client, urql, Relay and other clients, and a downloadable cheat sheet.

Spring Batch Reference — finite, bounded batch processing: the Job/Step/JobRepository domain model, configuring and running jobs, chunk-oriented and tasklet steps, fault tolerance (skip & retry), ItemReader/ItemProcessor/ItemWriter, scaling and partitioning, Spring Batch Integration, observability, cloud-native batch, and testing, plus a downloadable cheat sheet.

Scheduling — timed and recurring work in Spring Boot services: standard @Scheduled/TaskScheduler with ShedLock compared with Quartz 2.5, Quartz with Spring Boot (jobs, triggers, cron, misfires, calendars, listeners), persistent job stores on PostgreSQL, MySQL/MariaDB, Oracle, SQL Server, embedded SQL, MongoDB and Redis, clustering, dynamic scheduling, observability, testing and production practices, plus a downloadable cheat sheet.

OAuth Reference — OAuth as a protocol rather than a framework binding: OAuth 1.0a and its evolution into OAuth 2.0 and the OAuth 2.1 draft, access/refresh/ID tokens and the JOSE family, every grant type from authorization code with PKCE to the device grant and token exchange, the native-app and single-page-app profiles, the Security BCP, sender-constrained tokens (DPoP and mTLS), PAR/JAR and the FAPI profiles, OpenID Connect with discovery, logout and social login, passwordless and multi-factor authentication methods, and how all of it maps onto Spring Security 7, plus a downloadable cheat sheet.

Quarkus Reference — Quarkus, the Kubernetes-native Java framework built on build-time augmentation and the closed-world assumption: CDI (ArC), configuration and Dev Services, Quarkus REST and the reactive/web stack, Panache and reactive data access, Mutiny and messaging with Kafka, security and OIDC/Keycloak, observability, testing, packaging, native images with GraalVM and Kubernetes/OpenShift deployment, a Quarkus vs. Spring Boot comparison, and Java vs. Kotlin guidance, plus a downloadable cheat sheet.

Messaging Reference — asynchronous, broker-mediated communication between services: messaging models and patterns and delivery guarantees, Apache Kafka (architecture, producers, consumers, share groups, reliability and exactly-once, Kafka Streams, and Kafka Connect), RabbitMQ (the AMQP 0-9-1 model, queue types, routing patterns, reliability/dead-lettering, and AMQP 1.0), a Kafka vs. RabbitMQ comparison, and Spring Boot integration (Spring for Apache Kafka, Spring AMQP, and Spring Cloud Stream), plus a downloadable cheat sheet.

Architecture — the two halves of designing a backend system:

Docker — how Docker works and how to use it: the platform and its architecture (the Engine, containerd and runc, the OCI specifications), images and builds (Dockerfiles, the build cache and multi-stage builds, BuildKit and Buildx, supply-chain security), running containers (storage, networking, resources, logging and debugging), Docker Compose, registries, security and orchestration, and the Java/Spring Boot loop (Spring Boot images, Compose for local development, Testcontainers integration tests run locally and in GitHub Actions, and CI/CD image builds), plus a downloadable cheat sheet.

Kubernetes — how Kubernetes works and how to deploy and operate backend services on it: architecture and the object model, kubectl and local clusters with kind, workloads (Pods, probes, Deployments, StatefulSets, DaemonSets, Jobs and CronJobs, autoscaling), Services, DNS, Ingress, Gateway API and NetworkPolicy, ConfigMaps, Secrets and persistent storage, resources, scheduling, RBAC and Pod security, Kustomize, Helm, GitOps and operators, observability, debugging, cluster administration, and the complete Bookshelf application, plus a downloadable cheat sheet.

Terraform — infrastructure as code with Terraform and OpenTofu: how Terraform works, the HCL configuration language (providers, resources and data sources, variables, expressions, functions, meta-arguments, lifecycle rules and checks), the dependency graph, plan and apply, state and remote backends, workspaces and project structure, modules, import, refactoring with moved and removed blocks, secrets with ephemeral values and write-only arguments, testing, static analysis and policy as code, CI/CD, HCP Terraform and Stacks, AWS, Azure, Google Cloud, Docker, Kubernetes and Helm providers, provider development, OpenTofu, and the complete Bookshelf infrastructure, plus a downloadable cheat sheet.

Media Optimization — server-side image and video processing: formats and encoding (AVIF, WebP, JPEG XL, HEIC), responsive variants and thumbnails, BlurHash placeholders, video transcoding with a bitrate ladder, covers and thumbnails from frames, HLS, DASH and CMAF streaming, libraries for Java, Python, Node.js, .NET and Rust, upload pipelines with queues and jobs, and security and operations, plus a downloadable cheat sheet.

PDF Generation — producing PDF documents from a Java backend: the PDF file structure and standards (PDF/A, PDF/UA), iText 9 for programmatic layout, JasperReports 7 for template reports from databases, PAdES digital signatures with iText, PDFBox and EU DSS, editable AcroForms, barcodes and regulated QR codes, alternatives and migration from the older books, plus a downloadable cheat sheet.

Office Files (Word and Excel with Apache POI) — generating Word and Excel reports on a Java server and reading uploaded files with Apache POI: the component map and file formats, the spreadsheet usermodel, styles, formulas, SXSSF streaming writes and SAX streaming reads, XWPF documents, tables and templates, text extraction, encryption, security for untrusted uploads, download and upload endpoints, Spring Batch jobs, testing and migration, plus a downloadable cheat sheet.

Apache Tika — detecting file types and extracting text, metadata, embedded documents and language from more than a thousand formats with Apache Tika 4.1: media types and charset detection, the parser API and content handlers (Markdown, XHTML), metadata, recursive parsing, PDF parsing, OCR with Tesseract and VLM parsers, JSON configuration with TikaLoader, extending Tika, the tika-app command line, the tika-server REST API and tika-grpc, Docker and Kubernetes, Tika Pipes, limits, timeouts and security, Spring Boot, search indexing and RAG ingestion, tika-eval, testing, performance and migration, plus a downloadable cheat sheet.

JMeter — load and performance testing of backend services with Apache JMeter 5.6.3: performance testing fundamentals, the test plan model and its execution order, thread groups, ramp-up and the open workload model, timers and controllers, HTTP, REST, GraphQL and SOAP tests, recording and cURL import, test data, correlation, assertions and Groovy scripting, JDBC, JMS and other samplers, plugins and custom load shapes, gRPC load testing, CLI runs, results files, the HTML dashboard and real-time monitoring, analysis, distributed testing, tuning, CI/CD with Maven, Docker and GitHub Actions, DSLs, extending JMeter, troubleshooting and security, plus a downloadable cheat sheet.