Skip to the content

/

Hono

Hono 4

Hono: 0% done

Module 1 · How the web talks

A server is a program that waits for questions

Loading the slide…

A line of words about as long as a slide’s first line, and its second.

Another line, shorter.

1 / 180 · How the web talks

Course progress

0%

A server is a program that waits for questions
A URL is an address with parts
, 2 to practiseCheck: the parts of a URL
An API is a server that answers programs
The running example: a bookshop’s API
, 1 to practisePractise: one trip to the server
, 1 to practiseCode needs a runtime to run in
The tools you will use
Recap: how the web talks

HTTP is the language of requests and responses
Methods say what you want to do
, 2 to practiseCheck: choosing a method
Status codes say how it went
, 2 to practiseCheck: the right status
Headers carry details about the message
, 1 to practiseJSON is how APIs write data
, 1 to practiseSending requests from the terminal with curl
Recap: HTTP

REST organises an API around things
The bookshop’s routes
, 2 to practiseCheck: RESTful or not
Habits of a clear API
A server without a framework
, 1 to practiseTry it: one more route, by hand
What a framework adds
, 1 to practiseWhy Hono
Recap: REST and frameworks

Make a project with one command
What is in the folder
The smallest app, line by line
, 2 to practiseCheck: what the runtime calls
Run it on your computer
Your first real route: the book list
, 1 to practisePractise: an authors route
The same app on Node, Bun and Deno
, 1 to practiseReading your first error
Recap: a first app

Everything goes through the context
, 1 to practisePath parameters: the :id in the path
Query strings: filters and pages
, 1 to practisePredict: a missing query value
Headers and the body
Ways to answer
, 1 to practiseChoosing the status and headers
, 1 to practiseTry a route without a server: app.request
Recap: requests and responses

A route is a method, a path and a handler
Parameters: several, optional, and constrained
, 2 to practiseCheck: which paths match
Wildcards match the rest of the path
Routes are tried in the order you add them
, 1 to practisePractise: the route that never answers
Trailing slashes are different paths
, 1 to practiseChaining, and several handlers per route
Recap: routing

One small app per resource
A file for each group
, 1 to practisePractise: mount the authors group
, 1 to practisebasePath(): one prefix for everything
, 1 to practiseroute() copies routes at the moment you call it
Your own not-found answer
, 1 to practiseSee every route with showRoutes
Recap: organising routes

Middleware runs around your handlers
The onion: in through each layer, out in reverse
, 1 to practisePredict: what the log shows
Changing the response on the way out
, 1 to practiseAnswering early: return instead of next()
Choosing where middleware applies
, 1 to practiseReusable middleware with createMiddleware
, 1 to practiseThree rules for next()
Recap: middleware

Hono ships the middleware most APIs need
logger: see every request
cors: who may call your API from a browser
, 2 to practiseCheck: what CORS protects
secureHeaders: protective headers in one line
, 1 to practiseetag: “you already have this”
compress and bodyLimit
, 1 to practiseRequest ids, timeouts, and a sensible stack
Recap: built-in middleware

A thrown error becomes a 500
HTTPException: throw a status on purpose
, 1 to practisePredict: two kinds of error
onError: one place for every failure
Every error in one shape
, 1 to practisePractise: an error handler that leaks
, 1 to practiseErrors don’t reach the middleware’s try
, 1 to practisePractise: refuse a duplicate
Recap: errors

Every request is a stranger
validator(): check one part of the request
, 1 to practiseJSON validation needs a JSON Content-Type
Zod: schemas instead of ifs
zValidator: a Zod schema per target
, 1 to practisePractise: validate the book list’s query
Failing in your own shape: the hook
, 1 to practisePredict: what the handler sees
Recap: validation

Bindings: what the Worker is given
Tell Hono what c.env holds
, 1 to practiseReading the database in a route
Variables: what middleware hands to handlers
, 1 to practisePractise: a typed variable
Middleware can bring its own types
, 1 to practiseHelpers that take the context
Work after the response: waitUntil
Recap: bindings and variables

Two questions: who are you, and may you?
, 1 to practisebasicAuth: a username and password per request
Bearer tokens: a key instead of a password
JWTs: a signed note saying who you are
The jwt middleware checks the token
, 1 to practiseAuthorisation: check the role
Tokens in cookies, for browsers
, 1 to practisePractise: the stealable session
Recap: protecting routes

The server’s types, in the client
Exporting the app’s type
, 1 to practiseTypes flow through chained calls only
Calling routes: $get, $post, params, query, json
, 1 to practiseCheck the status, then read the body
Naming the types: InferRequestType and InferResponseType
, 1 to practiseWhat the types don’t see
Headers, and a custom fetch
Recap: RPC

A body can arrive in pieces
Making a stream: stream and streamText
, 1 to practiseCheck: errors halfway through
Server-sent events: live updates
, 1 to practisePractise: a countdown in events
HTML pages with JSX
, 1 to practiseValues are escaped, unless you say otherwise
One layout for every page: jsxRenderer
Recap: streaming and HTML

A test is code that checks code
, 1 to practiseapp.request: the whole app, no server
Giving the app an env
, 1 to practisetestClient: the typed client, in memory
Testing middleware on its own
Real bindings: tests inside the Workers runtime
, 1 to practiseTest the promises, not just the happy path
Recap: testing

A layout that grows well
One env type, one factory
Handlers in their own file keep their types with createHandlers
Thin routes, plain functions
, 1 to practiseWhere each middleware lives
, 1 to practiseSwappable services through variables
A documented contract with @hono/zod-openapi
Recap: large apps

One request, inside Hono
, 1 to practiseTry it: build the onion
Five routers, one interface
, 1 to practiseTry it: match a path, segment by segment
, 1 to practiseWhy one regular expression is fast
Presets: hono, hono/quick, hono/tiny
, 1 to practiseWhat actually makes an app slow
Caching at the edge with the cache middleware
, 1 to practiseMeasuring with Server-Timing
Recap: under the hood

A security review, in one table
, 1 to practiseClients can only set what the schema allows
, 1 to practiseOwnership belongs in the query
Rate limits: refuse floods early
Combining guards: some, every, except
, 1 to practiseMiddleware declares only what it needs
, 1 to practiseApp-wide variables with ContextVariableMap
Results that say how they can fail
Recap: security and types

How to take this challenge
, 1 to practisePredict: a guard that throws
, 2 to practisePredict: whose route answers
, 1 to practiseDebug: the client that lost a group
, 1 to practiseReview: a route from a pull request
, 1 to practiseOrder: one staff request, through everything
, 1 to practiseFill: the app, every piece in place
, 1 to practiseDesign: a wishlist
Capstone: build the bookshop API
Recap: the whole course