Security
The URL Fetcher That Read the Metadata Endpoint
The image preview feature fetched whatever URL it was given, so an internal address returned the instance credentials, and the response was rendered back to…
Performance
The Client That Opened a New Connection for Every Request
The HTTP client was constructed inside the call, so the pool was thrown away each time and every request paid the handshake, and the latency was the setup…
Tooling
The lsof Output That Showed Who Was Holding the Port
The bind failed with the address already in use and nothing in the project was running, and the listing named a leftover process from the previous session…
Security
The Rate Limit That Counted Every User as One
The limiter keyed on the connection address, and behind the proxy that address was the load balancer, so the whole office shared one bucket, and one user…
Deep Dive
The Missing Intermediate Certificate That Broke Android
The browser was happy and the phone was not, because the desktop had cached the intermediate and the mobile client had to build the chain from exactly what…
Error Autopsy
The Presigned URL That Expired Mid-Upload
The upload took longer than the signature window, so the final chunk was rejected with a 403, and the client reported a network error rather than an expiry…
Tooling
The tcpdump Capture That Showed Who Sent the Reset
The connection dropped at the same byte count every time, and the capture showed the reset arriving from the load balancer rather than from the application…
Deep Dive
Why the First Kilobytes Are the Slow Ones
A new connection starts with a congestion window of about ten packets and doubles it per round trip, so the first response is gated by the ramp rather than…
Error Autopsy
The DNS TTL That Was Still an Hour During the Migration
The cutover changed the record and the old address kept serving for an hour, because the TTL was never lowered in advance, and every resolver on the…
Security
The CORS Wildcard That Was Not Actually Safe
The origin header echoed back whatever the request sent and the credentials flag was on, so any site could read the authenticated response on the user's…
Deep Dive
Why the TLS Handshake Cost Three Round Trips and How to Lose Two
The first request paid for DNS, the TCP connect and a full TLS 1.2 negotiation before a single byte of the response arrived, and the round trips were the…
Security
The API Key in the Query String That Lived in Every Log
A key passed as a query parameter is copied into access logs, proxy logs, referrer headers and browser history, and rotation does not unlog it.