Blog

Take a JSON Web Token apart segment by segment, build a signer and verifier with nothing but node:crypto, then run the alg:none and RS256-to-HS256 key-confusion attacks against both your own code and jose@6.2.8 to see exactly which one still forges an admin token.

Shopify replaced Redis with MySQL SKIP LOCKED for inventory reservations. DoorDash replaced Redis Cluster with stateless Kvrocks. The lesson isn't "Redis is bad" — it's about matching infrastructure to access patterns.

Redis does more; Memcached does one thing faster. Here's exactly when that trade-off matters — plus why Valkey is now the open-source default in 2026.

Prisma 7 eliminated the Rust binary and closed the performance gap. So why are teams still choosing Drizzle? The real answer is about SQL transparency, bundle size, and who owns complexity.

Client-side validation is UX. Server-side validation is security. And a schema is not an auth guard — here's the fix that still ships an account takeover, and how to catch it in review.

A monotonic stack maintains elements in order and pops when that order breaks — finding the next greater element for every popped value in O(n) total.

Reading a 2 GB file all at once doesn't run out of memory — it hits V8's 512 MB string limit first. Streams process it in flat memory instead. Here's the pipeline pattern, custom Transform streams, and backpressure, with the numbers measured on Node 22.

The EventEmitter pattern lets components in the same process react to the same event without being directly coupled — no message broker needed.

Server Actions collapse form handling into a single server function—no API route, no manual fetch, no useState for loading. Here's the pattern that replaces 80% of your mutation boilerplate.