The MERN stack โ MongoDB, Express.js, React, and Node.js โ gives development teams the ability to use a single language and programming model across the full application. That consistency is a genuine advantage in development speed and team flexibility. It is also a subtle trap: because JavaScript can express almost anything, poorly structured MERN applications tend to accumulate complexity in ways that are difficult to untangle without significant refactoring.
Folder Structure: Convention Over Invention
Monolithic MERN applications that put everything in a single repository benefit from a clear, explicit folder structure that separates concerns before they are entangled. The server side should separate routes, controllers, middleware, models, services, and utilities. Controllers handle request parsing and response construction; services contain business logic; models define data structure and validation. This separation means business logic can be unit-tested without spinning up an HTTP server, and routes can be changed without touching business logic.
The React side benefits from a feature-based organisation as applications grow beyond a handful of components. Grouping files by feature (auth, dashboard, billing, profile) rather than by type (components, hooks, utils) keeps related code together and makes the codebase navigable without knowing the specific file to look for.
API Design: REST vs GraphQL for MERN Applications
REST and GraphQL are both viable API approaches for MERN applications, and the choice is not as consequential as advocates of each will suggest. REST is simpler to understand, easier to cache at the HTTP layer, and familiar to a larger pool of developers. GraphQL shines in data-heavy applications with complex relational queries where different clients (web, mobile, third-party integrations) need different projections of the same data.
For most applications, REST with thoughtfully designed endpoints is the right starting point. GraphQL adds complexity โ the schema, resolvers, and N+1 query problem mitigation with DataLoader โ that is not justified until you are experiencing the specific problems GraphQL solves. Starting with REST and migrating specific domains to GraphQL later is more viable than it sounds.
State Management: Right-Sizing the Solution
Over-engineered state management is one of the most common sources of unnecessary complexity in React applications. Redux is excellent for large applications with complex shared state, many state updates, and the need for reproducible state changes that can be tracked and debugged with dev tools. It is not necessary for a medium-complexity application, and its overhead โ actions, reducers, selectors, middleware โ can double the code required for straightforward features.
React Query (now TanStack Query) and SWR handle the most common state management need in real applications โ server state: fetching, caching, synchronising, and updating data from the API. These libraries often eliminate the need for Redux entirely by separating server state (which they manage) from UI state (which simple useState or useReducer handles). Starting with React Query for server state and useState for local UI state covers the majority of real applications without Redux’s overhead.
Authentication Architecture in MERN
JWT (JSON Web Tokens) is the standard authentication mechanism for MERN applications. Access tokens are short-lived (15 minutes to 1 hour), stored in memory, and sent as Bearer tokens in Authorization headers. Refresh tokens are longer-lived, stored as httpOnly cookies (not localStorage โ XSS can steal localStorage contents), and used to obtain new access tokens when they expire.
The httpOnly cookie / in-memory token split is important. Storing access tokens in localStorage makes them vulnerable to any XSS attack; storing refresh tokens in httpOnly cookies makes them inaccessible to JavaScript, which means an XSS attack cannot steal persistent credentials. This pattern adds complexity to the token refresh flow but is the correct approach for applications with meaningful security requirements.