security
2 posts
Why the admin area re-reads the session on every request
Session cookie caches are great for showing a name in the header and dangerous for deciding access. How the admin area, its actions and the account export bypass the cache.
4 min read
Store first, notify second: a contact form that survives a broken mail provider
How the contact form handles bots, floods and email outages: a honeypot, two throttles in one atomic upsert, and a message that is saved before anyone is notified.
4 min read
