Backend
Time Is a Bug: Timezones, Ordering, and Clock Drift
The three categories of time-related bugs that appear in production - timezone confusion, clock skew across distributed systems, and DST - and how to avoid each.
Backend
Backward Compatibility: Why Your API Cannot Change
Why renaming a field breaks integrations you did not know existed, what counts as a breaking change, and how to evolve APIs without causing incidents.
Backend
Idempotency and Retries: Why Your System Duplicates Everything
Why retries without idempotency cause duplicate charges, duplicate emails, and duplicate records - and how to design write operations that are safe to retry.
Backend
Webhooks: Design, Security and Debugging
Webhooks are HTTP callbacks that third-party services use to notify your application of events. Building a reliable webhook receiver requires handling retries, verifying authenticity, and processing events idempotently.
Backend
Rate Limiting: Why, What, and How
Why every public API needs rate limiting, the common algorithms and their tradeoffs, and how to implement it without reinventing the wheel.
Backend
JWT, Sessions, and OAuth2: What Each One Is Actually For
The differences between JWTs, server-side sessions, and OAuth2, and how to choose the right mechanism for the authentication problem you are actually solving.
Backend
Server Architecture Patterns: Monolith, Modular, Service-Oriented
Three architectural styles, their actual tradeoffs, and how to choose between them without falling into the microservices trap.
Backend
Authentication vs Authorization - and How to Implement Both
Two concepts that are constantly confused and constantly misimplemented. Here is what each means and how to get both right.