Three mistakes behind most Node API bugs
Most of the Node API bugs I've reviewed come down to the same 3 mistakes. None of them are exotic — that's exactly why they keep shipping.
1. Business logic living inside the route handler.
The controller fetches, calculates, validates, and responds, all in one 80-line function. It works until requirements change, and then every route is a merge conflict.
- Fix: controllers handle HTTP, services handle logic. A route should read like a table of contents: take the request, call a service, return the result.
2. Trusting input because "the frontend already validates it."
The frontend is a suggestion, not a guarantee. Anyone can hit your endpoint directly.
- Fix: validate at the edge, every time — shape, types, required fields — before the data touches your logic. Same rule whether it's a form or a partner integration.
3. One catch-all that swallows every error the same way.
A 500 for everything means the client can't tell "you sent bad data" from "our database is down", and neither can you at 2am.
- Fix: consistent, typed errors with the right status codes, logged with enough context to actually debug.
The nuance: don't over-correct. A 3-endpoint internal tool doesn't need layers of abstraction. Match the structure to the size of the problem.
Boring fundamentals, but they're the difference between an API you can extend and one you're scared to touch.
Which of these have you shipped? I've done all three, the error-handling one more than once.