The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Twilio Webhook Signatures Break Behind Load Balancers
Twilio's signature validation is more fragile than the docs let on. One body-parsing mismatch and you're silently dropping every inbound SMS.
Twilio's webhook signature validation is one of those things that works perfectly on your local machine and then silently fails in production for reasons that have nothing to do with your application code. I've been burned by this twice - once on a healthcare messaging integration and once setting up two-way SMS for a…
Read the daily →The nginx try_files Mistake Hiding in Every Laravel Config
The most-copied nginx config snippet for Laravel has a subtle try_files ordering bug that can expose your app internals. Here's what it does and how to fix it.
The most-copied nginx config snippet for Laravel has a security problem in it. It's been copy-pasted from Stack Overflow, DigitalOcean tutorials, and the Laravel docs themselves for years. Most people running it have no idea it's there. I didn't catch it myself until a pentest report came back on a client site and…
Read the daily →nginx limit_req vs limit_conn: They Solve Different Problems
Most nginx rate limiting configs I inherit conflate limit_req and limit_conn. They solve fundamentally different problems, and mixing them up will bite you.
Every time I inherit a server config from another dev or firm, I find the same pattern: and bolted on together, usually cargo-culted from a DigitalOcean tutorial, with no clear understanding of what either one is actually doing. They are not redundant. They are not interchangeable. They protect against different…
Read the daily →The I/O Signals That Tell You to Split the DB Off Your App Server
Running your database on the same VM as your app is fine until it isn't. Here's how I know when it's time to split them.
Single-VM deployments get a bad reputation they don't entirely deserve. For most of the apps I run for small and mid-size clients, one well-sized server with Nginx, PHP-FPM, and Postgres living together is the right call. Fewer moving parts, cheaper, easier to snapshot, easier to debug at 2am. But there's a point…
Read the daily →PHP-FPM Process Managers: Let the Numbers Decide
Dynamic, static, ondemand - most people just leave PHP-FPM on whatever the package default is. That default is probably wrong for your server.
Most servers I inherit have PHP-FPM sitting on whatever process manager the distro package dropped in. Usually , usually with defaults that were pulled from thin air. I've watched a $20/month DigitalOcean droplet spend half its life in swap because someone left on a box with 2GB of RAM. The fix takes five minutes once…
Read the daily →