—ArchiveIndex

Every article

The full index of Stateless, by section. 42 pieces in all.

APIs & Protocols

All →

01
APIs & Protocols
Idempotency-Key Implementation in REST APIs: Stopping Double Charges Without Missing the Second Request
Implementing idempotency keys in a REST API requires more than just deduplicating on key - it demands storing enough detail to reject mismatched retries and safely handle concurrent…
02
APIs & Protocols
409 vs 422: When to Use Which Status Code for a Rejected Request
As a developer, you've likely hit a code review where two hardworking colleagues spar over which HTTP status code to return for a rejected request. Is it 409 (Conflict) or 422…
03
APIs & Protocols
RFC 9457 Problem Details: Retiring Your Home-Grown Error JSON
When creating an error JSON, most engineers start by copying a format from a previous project. Over time, this casual practice leads to a proliferation of custom error shapes in every…
04
APIs & Protocols
Rate-Limit Headers: Telling a Client to Slow Down in a Way It Understands
Designing a client-readable rate-limiting policy for a public API requires sending the right headers at the right time. While the standard HTTP status code is 429 Too Many Requests, RFC…
05
APIs & Protocols
What Poker Platforms Teach About Secure API Sessions
Poker platforms move real money. They fight fraud every day. If their sessions fail, chips and cash can vanish. APIs face the same risks. A weak session lets an attacker…
06
APIs & Protocols
The Hypertext Application Language
HAL is a simple format that gives a consistent and easy way to hyperlink between resources in your API.

Web Platform

All →

01
Web Platform
CORS Preflight Requests Matter - The Browser Blocks Prods BUT NOT Your Local
The quick test looks great: your browser client sends the request, the dev server responds, and your UI updates happily. Delighted, you release into production. Minutes later, users are…
02
Web Platform
Vary Against Your CDN: How Content Negotiation Quietly Destroys the Hit Rate
A primary CDN vendor doc or RFC that explicitly quantifies how many cache entries a given Vary line creates, to allow comparison across different usage of Vary by a CDN engineer.
03
Web Platform
The Native <dialog> Element Replaced Your Modal Library — Here Is What It Still Will Not Do
The <dialog> element includes a lot of modal behavior out of the box.

Data & Databases

All →

01
Data & Databases
PgBouncer Prepared Statement Already Exists: Escaping the Pooling Prepared-Statement Collision
Database applications that combine a connection pooler with a client library that auto-tracks prepared statements discover quickly that the two reuse strategies do not mix. Without matching…
02
Data & Databases
Why Time-Ordered UUIDv7 Helps Your Indexes — and What It Costs
Newly specified UUIDv7 changes the front of the identifier from random pattern to time sequence, which changes how keys cluster in indexes. For database administrators weighing primary key…
03
Data & Databases
Keyset Pagination Skipping Rows: How to Avoid Row Skipping and Duplicates When Data Moves
Offset pagination is a common approach to fetching rows in chunks for an interactive feed. But it has a hidden problem: the page boundaries are not anchored to any actual rows, so when the…
04
Data & Databases
SQL NOT IN Returns No Rows for Subquery with One NULL
SQL's NOT IN operator can silently return no rows if its subquery has as much as one null. That's because the NOT IN predicate behaves like a chain of <> comparisons, all of which…

Infrastructure

All →

01
Infrastructure
Stale-While-Revalidate: What Happens During the Cache Revalidation Window
When the defined freshness of a cached web resource runs out, a cache can still serve the stale object to the client while silently revalidating it in the background. RFC 5861, which…
02
Infrastructure
Exponential Backoff, Full Jitter or Decorrelated: Choosing a Retry Scheme
Without jitter, client retries on rate-limit hit or concurrency overload are synchronized. Each client backs off the same amount, but is rate-limited on the same retry. Not until jitter…
03
Infrastructure
413 Request Entity Too Large: The Four Limits You Have to Raise
If your file uploads keep failing with a 413 Request Entity Too Large error, it's time to troubleshoot the limits at each hop between the client and your application. The 413 status means…

Security & Identity

All →

01
Security & Identity
HMAC Webhook Signatures: The Four Mistakes That Pass Code Review
Webhooks pass event data between client and server with clear security guarantees.
02
Security & Identity
Refresh Token Rotation and Reuse Detection: What the Attack Looks Like in Logs
You logged in and got a refresh token. You used it, and you got a new one. But now, after the interval between valid refresh-rotation windows, you try to use that first token again, as a…
03
Security & Identity
Passkeys in an Ordinary Web App: What You Still Need a Password For
The origin of account-management rules for passkey-based auth typically originates with Google’s 2026 autofill and discoverable-credential guidance, and ends with the NHI's updated guidance…

Engineering Practice

All →

01
Engineering Practice
Server-Sent Events vs WebSockets: Choosing a Transport by Failure Mode
If you are developing a live-event dashboard or feed, choosing the right transport protocol for pushing updates to the browser can make or break the user experience. Many developers start…
02
Engineering Practice
The Structured Logging Fields That Shorten an Incident
When a cloud-native application goes down, the production log is where on-call engineers turn to answer three crucial questions: which specific request failed, in which specific deployment…
03
Engineering Practice
The Smallest Feature Flag Service You Can Build Yourself
You would rightly think that a feature flag system is mainly a dashboard. a vendor or standards definition stating which part is foundational But the key architecture boundary lies…

—