I Added a Server, and Everyone Got Logged Out (Session vs Token)

Users complained about getting logged out after I scaled the servers. Here's my journey from Sticky Sessions to Redis Store, and finally to JWT.

July 12, 2025

Codemapo

·May 15, 2025

Browser Storage Guide: Cookies vs LocalStorage vs IndexedDB vs Cache API

A comprehensive deep dive into client-side storage. From Cookies to IndexedDB and the Cache API. We explore security best practices for JWT storage (XSS vs CSRF), performance implications of synchronous APIs, and how to build offline-first applications using Service Workers.

#Web#Browser#Storage#Security

Browser Storage Guide: Cookies vs LocalStorage vs IndexedDB vs Cache API

·December 1, 2025

Flutter: Mastering ProGuard & R8 Obfuscation

App crashes only in Release mode? It's likely ProGuard/R8. Learn how to debug obfuscated stack traces, use `@Keep` annotations, and analyze `usage.txt`.

#Flutter#Security#Obfuscation#Android

Flutter: Mastering ProGuard & R8 Obfuscation

·January 25, 2025

Blockchain: Replacing Trust with Code

Bitcoin is just part of it. How to create trust without a central authority, principles of decentralization, smart contracts, gas fees, Layer 2 solutions, DAOs, and the Oracle Problem.

#Web3#Blockchain#Bitcoin#Ethereum

Computer Science·August 21, 2025

Firewall: The Grumpy Gatekeeper Protecting Your Server

Why your server isn't hacked. From 'Packet Filtering' checking ports/IPs to AWS Security Groups. Evolution of Firewalls.

#CS#Network#Security#Firewall

Firewall: The Grumpy Gatekeeper Protecting Your Server

Back to List

10. Security Checklist for Token Auth

If you choose JWT, ensure you check these boxes:

Use HTTPS (TLS): Tokens sent over HTTP can be sniffed easily.
Short Expiry: Access Token should expire in 15-30 minutes.
HttpOnly Cookies: Store tokens in cookies, not LocalStorage, to prevent XSS.
SameSite=Strict: Prevent CSRF attacks by restricting cookie transmission.
Rotation: Issue a NEW Refresh Token whenever the old one is used. This detects theft (if an old token is reused, revoke everything).
Blacklist: Maintain a Redis list of revoked tokens if you need immediate logout capability.

Security is not a feature; it's a process.