Recipes
Step-by-step solutions for real development tasks.
699 published
Page 9 of 20
Validate OIDC Tokens with JWKS
Fetch the issuer JWKS, verify the signature, check iss, aud, exp and nbf, cache keys by kid, and refresh the key set on rotation.
Rename a Column with Zero Downtime
Introduce the new column, dual-write and backfill, switch reads, then drop the old column in a separate deploy so no release breaks the running app.
Implement Optimistic UI Updates with Rollback
Apply a UI change immediately, reconcile it with the server response, and restore the previous state when the request fails so the interface never lies.
Build Immutable Images with Packer
Define a Packer template that bakes a hardened base image, validate and build it in CI, and version the resulting image so instances boot identically.
Restrict Features with Permissions-Policy
Send a Permissions-Policy header that disables powerful browser features the app does not use, so injected or third-party code cannot call them.
Harden Pods with a Security Context
Run as non-root, disable privilege escalation, drop capabilities, use a read-only root filesystem, and set seccomp so a container breakout is much harder.
Add Fuzzy Search with Postgres Trigram Indexes
Enable pg_trgm, build a GIN index on the search column, and query with similarity operators so misspellings still match fast.
Share Outputs Across Pulumi Stacks
Export stack outputs, read them from another stack with StackReference, and keep dependency direction acyclic so infrastructure composes cleanly.
Guarantee Read-Your-Writes Consistency
Route a user's reads to the primary after a write, or carry a version token, so a user never sees their own change vanish on a replica.
Retry with Exponential Backoff and Jitter
Retry transient failures a bounded number of times with exponential delay plus jitter, and only retry operations that are safe to repeat.
Isolate Tenants with a Schema per Tenant
Give each tenant its own database schema, route connections by tenant, and run migrations across all schemas so isolation does not become a migration burden.
Prevent Session Fixation on Login
Rotate the session identifier on privilege change, regenerate the cookie after authentication, and invalidate the pre-login session so a fixed id cannot be reused.
Implement a Sliding-Window Rate Limit
Use a sliding window or token bucket with shared state so limits are accurate across instances and fair at the boundaries of fixed windows.
Replace SSH Keys with a Short-Lived CA
Run an SSH certificate authority, issue short-lived user and host certificates, and have servers trust the CA so key rotation and revocation are manageable.
Implement Stale-While-Revalidate Caching
Serve a cached response immediately while refreshing it in the background, and cap staleness so users get fast reads without permanently stale data.
Stream a Large CSV Export
Write rows to the response as they are read, flush periodically, and backpressure the database cursor so memory stays flat for large exports.
Add a Time-Series Retention Policy
Partition metrics by time, drop or roll up old partitions on a schedule, and keep queries bounded so storage and latency stay predictable.
Chain Traefik Middlewares for Defense in Depth
Compose rate limiting, security headers, and a circuit breaker as labeled middlewares so every routed service inherits the same protections.
Publish Events with a Transactional Outbox
Write the event to an outbox table in the same transaction as the state change, then relay it asynchronously with retries and idempotent consumers.
Prevent DOM XSS with Trusted Types
Enable Trusted Types, route unsafe sinks through a policy that sanitizes input, and keep string assignment from injecting scripts.
Map Internal Errors to Typed API Errors
Define an error taxonomy, convert thrown domain errors to stable codes and HTTP statuses, and log the internal cause without exposing it to clients.
Verify Partition Pruning Is Effective
Confirm that queries filter on the partition key and that the planner prunes unrelated partitions, using EXPLAIN and runtime statistics.
Add a Progress Bar for Streamed Work
Render progress to stderr so it does not pollute stdout, and suppress it when output is not a terminal.
Stop Slow-Starting Containers from Being Killed
Give JVM or migration-heavy containers a startupProbe with a generous budget so liveness never executes during boot and restart loops end.
Add Namespace Resource Quotas to Stop Noisy Neighbors
Bound CPU, memory, and object counts per namespace with ResourceQuota, require requests on every pod, and verify enforcement with a stress test.
Add PKCE to an OAuth Public Client Flow
Generate a per-request code verifier, send its challenge in the authorization request, and redeem the code proving possession of the verifier.
Add Bash Shell Completion
Ship a completion script that suggests subcommands and flags so users discover options without reading docs.
Add TOTP MFA Enrollment with Recovery Codes
Generate a provisioning QR code, verify a first code before enabling, store the secret encrypted, and issue single-use recovery codes.
Add Visual Regression Checks with Playwright Screenshots
Screenshot stable viewports with deterministic content, compare against committed baselines with a tolerance, and review diffs in the pull request.
Automate Canary Analysis and Rollback with Argo Rollouts
Replace manual canary judgment with an AnalysisTemplate that queries error rate and latency metrics and promotes or rolls back automatically.
Find Duplicate Packages Inflating Your Frontend Bundle
List version-multiplicated packages in the dependency graph, trace which import paths pull each copy, and collapse them into one.
Analyze Tail Latency Outliers Beyond the Averages
Compute P50, P99, and P99.9 from raw latency samples, group outliers by instance and endpoint, and find the one slow replica dragging every hundredth request.
Archive Cold Rows to a History Table
Move old rows into an archive table in bounded batches so the hot table stays small and query plans stay stable.
Assert Structured Log Fields
Capture structured logs in tests and assert on fields rather than substrings so logging behaviour is regression-tested.
Audit API Error Response Shapes for Consistency
Collect real 4xx and 5xx responses across endpoints, normalize them into a report of shapes and fields, and converge everyone onto one error envelope.
Audit JWT Refresh Token Rotation and Revocation
Inspect access and refresh token lifetimes, verify refresh rotation invalidates the old token, and test revocation actually blocks reuse.