CSRF: Why Double-Submit Cookie Falls Short for Financial-Grade Security
Synchronizer token server-side vs double-submit cookie: when the latter fails, why middleware wire-order matters, and how to handle JS non-form requests.
Lessons learned, problems and solutions
Synchronizer token server-side vs double-submit cookie: when the latter fails, why middleware wire-order matters, and how to handle JS non-form requests.
First N failures are silent, then exponential backoff capped at 15 min. Why the status code must never distinguish locked vs wrong creds, and how to reset properly.
If your login responds in 1ms for unknown users and 50ms for known ones, you have an oracle. The fix is 3 lines. The trap that breaks it 6 months later is just one config change.
A PKCS#12 encrypted with AES-256, imported successfully by certutil, but ECDSA unusable in Edge. The CryptoAPI vs CNG routing trap and the MS KSP attribute fix.
How I built a bilingual FR/EN brochure site in PHP 8 with no framework or CMS: 7-layer anti-spam without captcha, strict CSP with CDNs, optimized LCP and full GitHub Actions CI/CD pipeline.
How I automated email filtering, unsubscribes and cleanup across 58,000 Outlook and Gmail messages using Claude Code, MCP servers, Graph API and RFC 8058 One-Click Unsubscribe.
How I built a React SVG component kit (circuits, triangles, 3D volumes) and deterministic question generators tested by pre-commit hooks across 200 seeds per gen.
How I migrated a React SPA to TypeScript using Babel Standalone, no webpack or vite, while keeping file:// compatibility and a 50-line build script.
How I built a Brevet exam prep platform in React: randomized quizzes, weighted scoring, skills radar, badges, dyslexia mode and adaptive question selection.
Should you audit controllers, entities, or slice by feature? Lessons learned on the order that avoids touching the same code three times.