@system_monarch Retries multiply across layers. A retrying B and B retrying C turns one call into a flood against a service that’s already down, commonly referred to as a retry storm.
The fix is a circuit breaker
Your new colleague, a security expert, swears this admin endpoint is bulletproof: the JWT is issued by the server, and the code explicitly checks the payload for the admin role.
Now it's in production, and attackers are making themselves admins. What's wrong with it?
A table with 10 million rows. A query that needs one of them. Without an index, the database reads all 10 million. With one, it finds the row almost instantly. Here's how indexes enable that.
@Its_Nova1012 Depends on the use case: if neither time-ordering nor insert performance matters (e.g.g small table, low writes), there's no real reason for v7. v4 is the better default: no leaked creation time, more random bits (122 vs ~74). v7's whole pitch is index locality.
Every REST API uses the same five HTTP methods, but most devs only really think about GET and POST.
PUT vs PATCH is the one that trips people up in code reviews. Here's what each one does and when to reach for it.
@SahilExec Two flaws: no rate limit, and a code that never expires or gets consumed.
A 6-digit code is a million guesses, and the password already passed before this check, so a logged-in session can try all of them.
Fix: short-lived, single-use codes behind an attempt cap.
When two services need to talk to each other, REST and gRPC are the two most common choices. Both work. But they solve for different things. Here's when to reach for which.
Not sure if a query is actually using an index? Prepend EXPLAIN to any SELECT and the database will show exactly how it plans to execute it, including whether it picks an index or scans every row.
@SahilExec The cache key never included the user ID.
Anything that changes the response should be in the key, and the requesting user is one of those things.
@SahilExec I don't really see a way in. The id comes from a verified token (assuming auth works correctly), not a request field, so nothing to swap. And is_premium is read live from the DB on every call, so a canceled subscription applies instantly. What am I missing?
@Its_Nova1012 Cursors. Offset pagination reads and discards every row before the requested page, and millions of users make that costly
https://t.co/anClBpTKec
Classic pagination bug: a product search feels instant on the first few pages, then gets slower the deeper it goes. A few hundred pages in, response times stretch into seconds and CPU usage goes up. OFFSET is the culprit, and the fix is a one-line change to the query.
How do websites know your credit card number is invalid before making any API calls? The Luhn algorithm. It’s a simple checksum baked into every card number.
Why do array indexes start at 0?
It's one of those things most developers just accept without thinking twice. The reason comes down to how arrays are actually stored in memory.