Blog
Patterns from production work — authentication, real-time interfaces, and the parts of frontend architecture that decide whether the next change is cheap.
3 posts
RBAC that can't drift
5 min read
When navigation and route guards are written separately, they disagree. Derive both from one permission map and the disagreement becomes impossible.- auth
- architecture
- react
Collapsing concurrent 401s into a single refresh
5 min read
When a token expires mid-page, every in-flight request fails at once. Queue them behind one refresh instead of firing one per failure.- auth
- react
- typescript
Your React app should never hold an auth token
5 min read
Access tokens in JavaScript are readable by any script on the page. A thin backend-for-frontend removes the problem instead of managing it.- auth
- react
- architecture