Search

Lessons (40)

• Authentication, Authorization & API Security

  … user.role }, process.env.JWT SECRET, { expiresIn: "15m" }); function authenticate(req, res, next) { const token = req.headers.authorization …

• AWS Security Building Blocks

  … IAM roles authorize workloads to call AWS APIs. A customer JWT should not become an administrator credential, and …

• API Contracts, Gateways and Security

  Make APIs evolvable and safe with explicit formats, versioning, idempotency, gateway policy, authentication and authorization. The problem in …

• Storage, Search and Location Queries

  … Check authoritative visibility for sensitive or deleted results. 3. Use scoped upload/download authorization, neighboring geo cells and …

• Product-Scale Frontend Patterns

  … For money movement, inventory reservation or destructive operations, prefer confirmation and a server-authoritative result. Offline-first is …

• RBAC and Cluster Security

  … who are you?] A -- Z[Authorization: RBAC, may you?] Z -- M[Admission: is it valid and allowed?] M …

• Edge, Platform & Frontend Delivery

  … locale, tenant, device variant where necessary, and authorization scope. Incorrect caching can become a data leak. Make deployment …

• Design a File Storage Service

  Upload bytes directly to object storage while the API owns durable metadata, authorization, sharing and synchronization. The problem …

• DBMS Foundations, Keys & Normalization

  … What is normalization and why use it? Normalization organizes facts so each fact has one authoritative home. It …

• S3: Store Files Safely

  … Anyone possessing it can use its authorized operation until it expires; treat it like a temporary credential and …

• AI Agents and Tool Use

  … The model proposes an action; application code should decide whether the action is valid and authorized. mermaid sequenceDiagram …

• Data Structures for Scale

  … a positive answer needs authoritative confirmation when false positives matter. 3. Use HyperLogLog for approximate cardinality within an …

• System Design Interview Framework

  … 5. Define APIs with authorization and idempotency. 6. Deep dive into the hard invariant/bottleneck. 7. Close with …

• Proxies, APIs and Real-Time Protocols

  … Reconnect with a cursor and fetch authoritative state. A live socket is a transport, not a replacement for …

• Networking, DNS and Traffic Routing

  … Choose DNS or anycast routing with explicit convergence assumptions; provision fallback capacity and keep authoritative writes protected during …

• Developer Learning Plan and Document-Assistant Capstone

  … 4. Add generation: send only authorized retrieved passages and the question to a model. Ask it to answer …

• Design a Social Media Feed

  … Precompute inbox entries for ordinary authors using bounded workers. 2. For high-fan-out authors, merge recent posts …

• Caching, Consistent Hashing and Sharding

  … On a miss, read the authoritative database. 4. Put that result in cache with a bounded TTL and …

• Multi-Region and Disaster Recovery

  … Fence the former writer before promoting a new authority. Route traffic only after data and service readiness checks …

• Design a Ride-Sharing Service

  … Attempt a conditional assignment against the driver’s authoritative state, using ride ID and a lease/version. 3 …

• Collaborative Document Editing & Real-Time Sync

  … API and protocol http GET /docs/{docId} - { snapshot, snapshotRev, opsSince[], acl } GET /docs/{docId}/history?before= - [ { rev, author …

• Design an E-Commerce Checkout

  … Reserve stock with an authoritative conditional transition. 2. Persist workflow state and use the same payment identity on …

• What Is Artificial Intelligence? A Developer's Guide

  … select actions Look up an order through an authorized tool ML is part of AI, and deep learning …

• CloudFront: Faster Websites and Safer File Delivery

  … This authorizes a particular CloudFront distribution to read objects. It does not by itself authenticate visitors to that …

• IAM: Who Can Do What

  … Attach this policy through your authorized role-management process; do not assume your learner identity can edit IAM …

• Node.js and Express

  … Bearer … req.get("authorization") Middleware: the pipeline ⭐ A middleware is (req, res, next) = { … } . It can read/modify the …

• How a Web Request Works

  … The server proves its identity with a certificate signed by a trusted authority, which is the padlock 🔒 in …

• Backend Design Scenarios

  … keep the celebrity's posts in an author timeline and merge them into a user's feed when …

• VPC Endpoints, Transit Gateway and Hybrid Networking

  … Its policy restricts the path; the workload still needs authorization. See [interface endpoint configuration](https://docs.aws.amazon …

• AWS Interview Questions: Clear Answers

  … Encryption protects stored data, while access policies determine who may read it through authorized APIs. Configure both. A …

• Frontend Security

  … The backend must validate and authorise everything again. And never put secrets (API keys with write access, database …

• Putting AI Systems into Production

  … Do not allow a model response to bypass normal authorization or business rules. Latency and cost Track requests …

• DynamoDB Modeling, RDS Scaling and Data Resilience

  … Apply authorization to every page and bound requested result sizes. GSIs are eventually consistent. Immediately querying an index …

• Embeddings, Semantic Search, and RAG

  … Enforce document permissions before retrieval, keep citations traceable, and avoid returning information the requester is not authorized to …

• AI Evaluation, Safety, and Security

  … For tool use, test argument validation, authorization, retries, timeouts, and harmful actions. Measure latency and cost alongside quality …

• Batch vs Stream and Data Modeling

  … Keep transactional purchase records authoritative and normalized where constraints matter. 2. Run streaming fraud checks with stable event …

• Transformers and Large Language Models

  … For high-impact uses, add authoritative sources, human review, explicit validation, or a non-AI rule-based check …

• Environments, Workspaces, and Multiple Accounts

  … Use an appropriately authorized assume role configuration for cross-account operations. Verify caller identity and target account before …

• Design a Polite Web Crawler

  … A Bloom filter can reduce lookups but false positives mean it cannot be the sole authority when complete …

• Serverless: Lambda and API Gateway

  … Use the HTTP API payload format expected by the handler, authorize API Gateway to invoke this function, and …