Where I write down the things that took me a while to work out, with code that runs.
11posts
6topics
32min of reading
11 posts.
Engineering
A layout is not an authorization boundary
Putting the permission check in the dashboard layout feels natural. Next does not re-render layouts on client navigation, and a crafted RSC request can target a page segment directly.
August 15, 20263 min read86
Engineering
Rate limiting per person, not per IP
Limiting by IP means one office behind a shared NAT burns through the quota together. And middleware never sees a Server Action.
August 13, 20263 min read84
Engineering
dangerouslySetInnerHTML and the allowlist
Blocking script tags is the easy part. The hard part is iframes, and the javascript: scheme sitting in an href you forgot about.
August 11, 20263 min read85
Web
Google does not participate in IndexNow, so who does?
Google's Indexing API returns 200 for every URL you submit, including the ones it will never use. That is the most time-wasting trap in the indexing space.
August 9, 20263 min read82
Web
Why Tailwind's -500 ramp is uneven, and how OKLCH fixes it
amber-500 and indigo-500 sit on the same step of the palette. Measured, their lightness differs by 0.27. That is why a row of multi-coloured icons reads as noise.
August 6, 20263 min read82
Web
Dropping the top nav bar on mobile entirely
This site has no header on a phone. Just a dock along the bottom edge, and the hardest decision in it was the number 4.
August 4, 20263 min read84
Engineering
Next's two cache layers, and the bug that only shows up on the second request
cache() and unstable_cache() sound like two names for one thing. They solve different problems, and mixing them up produces a genuinely irritating TypeError.
August 2, 20263 min read84
Engineering
A CSP strict enough to block my own dev server
Dropping 'unsafe-eval' from the Content-Security-Policy was the right call. It also killed every dynamic import on localhost, while production was perfectly fine.
July 28, 20263 min read85
Web
A static page can still read ?tag= from the URL
Reading searchParams on the server is the fastest way to turn a prerendered page into an on-demand one. Here is how to keep both.
July 24, 20263 min read84
Engineering
Adding one module touches 12 files, and none of them will tell you
The new feature worked on the first try. Three weeks later it turned out it was missing from the sitemap, missing from search, and the save button quietly did nothing.
July 20, 20263 min read85
TypeScript
The Day I Realized 90% of Developers Are Writing Bad Code (And I Was One of Them)
You don't need another framework. You need to stop writing code you'll hate six months from now.
