Backend-Focused Software Engineer | Node.js, Express, Redis | Scalable API Design, Auth Systems, Caching | MERN

github

Anshul Kumar Arya  • Peerlist

Problem it solves: Most MERN projects hand-wave authentication. This system implements real production auth: token lifecycle, role-based access, security hardening, and observability. Key Highlights • Built a JWT-based authentication system using access + refresh tokens with proper expiry handling • Implemented refresh token rotation and server-side token invalidation to prevent replay attacks • Designed Role-Based Access Control (RBAC) for Admin, Manager, and User roles using middleware • Secured auth flows with httpOnly cookies, bcrypt password hashing, and rate-limited endpoints • Added protected backend routes and frontend route guards for authenticated & authorized access • Implemented audit logging to track who did what and when (auth events + protected actions) • Built production-grade health checks (uptime, DB connectivity, memory usage, response time) • Structured backend with clean MVC architecture and reusable middleware • Designed for multi-device sessions with refresh token tracking per login • Deployed-ready with environment-based config and security best practices Tech Stack • Backend: Node.js, Express, MongoDB, Mongoose • Auth & Security: JWT, bcrypt, httpOnly cookies, rate limiting • Frontend: React (protected routes & role-based dashboards) • Architecture: Middleware-driven authorization, token lifecycle management What this demonstrates • Deep understanding of authentication vs authorization • Real-world handling of token expiry, rotation, and logout • Security-first backend design (not tutorial-level auth) • Ability to explain why decisions were made, not just implement them

Multi-Tenant Authentication & Authorization S

NotesMan is a fully responsive and feature-rich notes application built with React, Vite, and Tailwind CSS. The project focuses on real-world UI/UX patterns, mobile-first design, and clean state management using React Hooks. Key Features: • Create, edit, delete notes • LocalStorage persistence with auto-sync • Pinned notes system (priority sorting) • Smart search with dynamic filtering • Fullscreen mobile preview • Dedicated Add Notes modal for mobile • Desktop split-view layout (List + Preview) • Smooth navigation, confirmation modals, and reusable components Technical Highlights: • React Hooks (useState, useEffect, useRef) • Custom localStorage data sync logic • Modular component architecture • Controlled forms for adding/editing notes • Derived state for filtering & sorting • Tailwind-based responsive rendering (mobile/desktop UX changes) • Lucide Icons for a minimal UI This project helped strengthen my understanding of component communication, state lifting, conditional rendering patterns, and building scalable UI logic in React. The codebase is structured to support future features like tags, filters, trash system, and dark mode.

NotesMan – Responsive Notes Application (Reac

Production-grade Weather API platform demonstrating enterprise-level backend engineering practices through deliberate over-engineering for learning and portfolio credibility. Core Engineering Implementations: • Layered Architecture: Clean separation across controller, service, and provider layers enabling independent evolution, testability, and provider replaceability without touching routes • Redis-Based Caching: TTL-based caching strategy (5-min window) with cache key normalization, dramatically reducing external API calls while ensuring data freshness • Distributed Rate Limiting: Redis-backed throttling (10 req/60s per API key) providing distributed-safe state management across multiple instances • Graceful Degradation: Fail-open architecture where Redis failures bypass cache and rate limiting without causing downtime, mirroring production resilience patterns • API Key Authentication: Lightweight service-to-service authentication enabling per-consumer rate limiting and access control • Provider Abstraction Layer: Normalized external API integration (OpenWeatherMap) preventing vendor lock-in and enabling seamless provider switching • Centralized Error Handling: Consistent error responses with proper HTTP status codes and no internal detail leakage Request Lifecycle: Authentication → Rate Limiting → Cache Layer → External Provider → Normalized Response This architecture mirrors real-world backend systems used in production, not toy demos—demonstrating scalability, testability, and professional code organization principles. Stack: Node.js, Express.js, Redis, OpenWeatherMap API, RESTful design patterns