Journal
Writing
Opinionated engineering notes—security, scalability, correctness, and the interfaces between humans and machines. No listicles—just explanations you can reuse in prod and in interviews.
Filter
Matching posts
Showing 4 of 35. Clear filters
- SecurityAugust 12, 20267 min read
JWT Access and Refresh Token Strategy
Design short-lived access tokens and rotating refresh-token sessions with revocation, browser protections, and key rotation.
JWTrefresh tokensauthenticationweb security - SecurityAugust 8, 20269 min read
Fix Nodemailer TLS Certificate Hostname Errors
What ERR_TLS_CERT_ALTNAME_INVALID means when Nodemailer connects to an SMTP server, why it happens, and how to fix it without disabling certificate verification.
NodemailerTLSSMTPNode.js - SecurityMay 7, 20268 min read
Hashing vs Encryption vs Encoding — The Differences Developers Must Understand
A production-minded map of encoding, hashing, and encryption—salts, passwords, JWTs, Base64 myths, interview answers, and the mistakes reviewers catch.
cryptographypasswordsJWTbackend - SecurityApril 2, 20262 min read
JWT authentication without mythology — rotations, revocation, and session ergonomics
Symmetric versus asymmetric verification, JWKS fleets, leaky storage pitfalls, and when opaque cookies outperform bearer tokens.
JWTsessionsOAuthAPI design