@eshah

Rate Limiting and API Security: Stop DDoS Before It Kills Your Service

Jan 27 · 12 min read · Introduction At 3 AM, I got paged. Our API was down. Not a bug. Not a deployment issue. Someone was hammering our login endpoint with 10,000 requests per second. No rate limiting. The database collapsed under the load. We scrambled to add IP blocking...

Authentication Patterns: JWT, Sessions, OAuth - What Actually Works

Jan 1 · 9 min read · Introduction I've implemented authentication wrong more times than I'd like to admit. JWT tokens stored in localStorage (rookie mistake). Session cookies without proper security flags. OAuth flows that leaked tokens. Password resets that were exploit...

GraphQL vs REST: When to Use Each (A Pragmatic Guide)

Dec 22, 2025 · 8 min read · Introduction I've built APIs both ways. REST APIs that worked beautifully. GraphQL APIs that were a nightmare. And vice versa. The "GraphQL vs REST" debate is exhausting. Everyone has strong opinions. GraphQL fanboys say REST is dead. REST purists sa...

Building Production-Ready REST APIs in Go: A Complete Guide

Dec 21, 2025 · 8 min read · Introduction I've built a lot of REST APIs. Some were garbage. Some actually worked in production. The difference? The working ones followed patterns. They had structure, error handling, validation, observability, and graceful shutdown. In this post,...

Go Error Handling Done Right: Patterns for Production Code

Dec 17, 2025 · 9 min read · Introduction I'll be honest—when I first saw Go's error handling, I hated it. result, err := doSomething() if err != nil { return err } "Are you kidding me? I have to check errors after EVERY function call?" Coming from languages with try-catch ...