6 Misunderstood Details of JWT
Don’t put private data in JWTs. Also pin algorithms, rotate refresh tokens with reuse detection, opaque vs JWT, hex/Base64 secrets, and real revocation.
Blog Posts
The blog posts I've written for you.
HMAC-SHA256 Signed API Auth From Scratch
Learn HMAC-SHA256 API signing from scratch: canonical request strings, anti-replay timestamps, constant-time compares—and when OAuth is the wrong tool.
Why Did CSS Mask Fail on Cross-Origin? — The CORS, Caddy, and Cloudflare Trifecta
Debugging cross-origin CSS mask-image failures behind Caddy and Cloudflare. Why masks require CORS, handling dynamic origins, and fixing Vary: Origin.
How to Prevent Email Enumeration: The "Silent Success" Security Strategy
Learn how to prevent email enumeration using the "Silent Success" strategy and generic "if your email exists" messages to secure your web app.
How to Convert MP4, MOV, MKV to OGV with FFmpeg and Play in Godot
Learn how to convert videos to OGV using FFmpeg and set up a VideoStreamPlayer to play them natively in Godot.
Mixed Content Errors in Django: The X-Forwarded-Proto Header You're Ignoring
Are browser consoles blocking your Django static files? Learn how configuring the X-Forwarded-Proto header solves Mixed Content errors instantly.