Authentication typically happens in one of two places: the frontend checks if a user is logged in before showing protected UI, and the backend validates tokens before processing requests. There's a third option—verifying JWTs at the edge, in a Cloudflare Worker, before requests reach your backend infrastructure.
API keys for backend authentication create a fundamental challenge in web applications: the credentials need to authenticate requests but cannot be exposed to clients. Hardcoding keys in frontend bundles or environment variables leaves them visible in browser developer tools. Anyone who opens the network tab can extract the key and
When building a React SPA with Cloudflare as the CDN it is possible to use S3 for static asset storage. If you have all of your resources typically on AWS, but want some of the advantages of Cloudflare, you can build a system that is very similar to the traditional
After four months of running a fully self-hosted Ghost CMS on AWS, I made a decision that might seem counterintuitive: I moved to Ghost Pro managed hosting. But here's the thing—I kept all the custom Lambda-powered features I'd built. This post documents that migration and
Preparing for re:Invent 2025 If you've been following this blog, you might have noticed things have been quieter than usual. The technical deep dives, infrastructure walkthroughs, and problem-solving posts have slowed to a trickle. There's a good reason for this temporary silence - I'
Ghost requires a MySQL database, persistent storage for content and images, and a way to handle traffic at scale. AWS provides these through RDS Aurora, EFS, S3, and ECS Fargate. This post walks through deploying the core infrastructure using AWS CDK, which allows us to define everything as TypeScript code
A comprehensive guide on using Cloudflare as a security and CDN layer for AWS-hosted applications, with edge-level API key injection
Learn how to build a Lambda function that automatically downloads survey response data from Qualtrics using their export API
A deep dive into resolving Docker BuildKit attestation manifest incompatibilities that prevent ECS deployments, including investigation steps and solutions.
Getting psycopg2 to work in AWS Lambda can be frustrating. This post shows you two reliable solutions - using pre-compiled binaries for simplicity, and building from source with Docker for production workloads.