Web Dev & Tooling Guides
Short, practical notes on the things our tools touch — encoding, auth, accessibility, data formats, and scheduling.
How to Verify Webhook Signatures with HMAC-SHA256
Verify webhook signatures safely: HMAC over the raw body, constant-time comparison, timestamps against replays — with Node, Python and Next.js examples.
Unexpected Token in JSON at Position 0: What It Means and How to Fix It
Why JSON.parse and response.json() throw "Unexpected token '<'" or "Unexpected end of JSON input", how to see what you really received, and how to fix it.
413 Request Entity Too Large in nginx: How to Raise the Upload Limit
Fix 413 Request Entity Too Large: raise nginx's client_max_body_size, then the limits in PHP, Express, Next.js, Kubernetes ingress and your hosting platform.
ERR_TOO_MANY_REDIRECTS: How to Find and Fix a Redirect Loop
"Redirected you too many times" means two rules are sending the browser in a circle. How to trace the loop with curl and fix the usual causes.
npm EACCES Permission Denied: Fix Global Installs Without sudo
Fix npm's EACCES permission denied errors on global installs and root-owned cache files — with a version manager or a user-level prefix, never sudo npm.
Mixed Content Errors: Fixing HTTP Resources on an HTTPS Page
Why browsers block http:// scripts, styles and API calls on HTTPS pages, how to find every mixed-content request, and how to fix it for good.
Docker: Permission Denied While Connecting to the Docker Daemon Socket
Fix "permission denied while trying to connect to the Docker daemon socket" on Linux: the docker group, why chmod 666 is a bad idea, and rootless alternatives.
Security Headers Checklist: 6 HTTP Headers Every Site Should Send
The response headers that harden any website — HSTS, CSP, nosniff, Referrer-Policy, Permissions-Policy and frame protection — with values and config.
Content Security Policy (CSP): A Practical Guide with Nonces
How to write a Content-Security-Policy that blocks XSS without breaking your site: report-only rollout, nonces, hashes, strict-dynamic and common fixes.
SameSite Cookies Explained: Strict, Lax and None
What SameSite=Strict, Lax and None actually do, which requests send cookies, the Lax default, CSRF protection, and why logins break after a redirect.
npm ERESOLVE Unable to Resolve Dependency Tree: How to Fix It
What npm's ERESOLVE peer dependency error means, how to read it, and the right fix: upgrade, overrides, --legacy-peer-deps or --force.
EADDRINUSE: Address Already in Use — How to Free the Port
Fix 'Error: listen EADDRINUSE: address already in use :::3000' — find what holds the port on macOS, Linux and Windows, stop it, and keep it from coming back.
Unix Timestamps Explained: Seconds vs Milliseconds, Time Zones and 2038
What a Unix timestamp is, how to tell seconds from milliseconds, converting in JavaScript, Python, SQL and the shell, and why 2038 matters.
How to Undo the Last Git Commit: Reset, Revert or Amend
Undo your last Git commit safely: keep or discard the changes with reset, fix it with amend, undo a pushed commit with revert, and recover with reflog.
Retrying HTTP Requests: Exponential Backoff, Jitter and Idempotency
Which HTTP errors are worth retrying, how to back off with jitter, how to honour Retry-After, and why idempotency keys make retries safe for payments and POSTs.
How to Fix "Permission denied (publickey)" in SSH
What 'Permission denied (publickey)' means, how to see which keys ssh offers, and fixes for wrong users, missing keys, agents, file permissions and disabled RSA keys.
Cron Job Not Running? 10 Things to Check
Your crontab entry looks right but nothing happens. The ten usual suspects — PATH, environment, % signs, permissions, time zones — and how to debug each.
How to Fix 502 Bad Gateway in nginx, Step by Step
A 502 from nginx means the app behind it failed. How to read the error log, then fix nearly every cause: stopped apps, wrong sockets, crashes and buffers.
Regex Lookahead and Lookbehind, Explained with Examples
Lookarounds match a position, not characters. How (?=…), (?!…), (?<=…) and (?<!…) work, with practical examples and engine support.
CORS Errors Explained: How to Fix "No 'Access-Control-Allow-Origin' Header"
Why browsers block cross-origin requests, how preflight requests work, and how to fix the common CORS errors on the server — without reaching for a wildcard.
HTTP Caching Explained: Cache-Control, ETag and 304 Not Modified
How browsers and CDNs decide what to cache: Cache-Control directives, freshness, ETag revalidation and 304s — plus a caching setup that works for most sites.
chmod 755 vs 644: Linux Permissions for Web Servers
Directories get 755, files get 644 — but why? How read, write and execute work on files versus directories, and how to fix permission errors without chmod 777.
^ vs ~ in package.json: npm Version Ranges Explained
What the caret and tilde mean in npm version ranges, why 0.x versions behave differently, and why your lockfile matters more than either symbol.
502 vs 503 vs 504: What Each Gateway Error Means
502 Bad Gateway, 503 Service Unavailable and 504 Gateway Timeout look alike but point at different failures. How to tell which layer broke, and how to fix it.
401 vs 403: Unauthorized or Forbidden?
401 means the server doesn't know who you are; 403 means it does and the answer is no. How to tell them apart, which to return from your API, and how to debug each.
301 vs 302 vs 307 vs 308: Which Redirect Should You Use?
Four redirect codes, two questions: is the move permanent, and must the method be preserved? A practical guide for SEO, browsers and APIs, with framework defaults.
How to Read Any Regex, Token by Token
Regexes look like line noise until you read them left to right, one token at a time. Here's the decoding method, the six token types, and the traps.
YAML vs JSON: Differences, Gotchas, and When to Use Each
YAML is JSON with comments and less punctuation — and a few sharp edges. Here's how they differ, the Norway problem, and when to pick one over the other.
URL Encoding: What Gets Percent-Encoded and Why
URL encoding replaces unsafe characters with %XX escapes. Here's which characters are reserved, why spaces become %20 (or +), and the encodeURI vs encodeURIComponent trap.
WCAG Contrast Ratios: What 4.5:1 Actually Means
WCAG contrast is a ratio between text and background luminance. Here's how the 4.5:1 and 3:1 thresholds work, the large-text exception, and how to hit AA and AAA.
Why You Shouldn't Hash Passwords with SHA-256
SHA-256 is a great hash — and a terrible password hash. Here's why fast hashes fail at password storage, and what bcrypt does differently.
UUID v4 vs ULID: Which Should You Use for IDs?
UUID v4 is random and ubiquitous; ULID is sortable and compact. Here's how they differ, why random IDs hurt database indexes, and when each is the right choice.
Cron Expressions Explained, Field by Field
A cron expression is five fields that describe a schedule. Here's what each field means, how the special characters work, and the one gotcha that trips everyone up.
px, rem, and em in CSS: When to Use Each
px is absolute, rem is relative to the root, em is relative to the element. Here's a practical guide to choosing the right CSS unit — and avoiding em's compounding trap.
How JWT Signing Works (and Why You Can't Verify It in the Browser)
A JWT's signature is what makes it trustworthy. Here's how HS256 and RS256 signing actually work, and why verifying a token client-side is impossible.
Base64 vs Base64URL: What's the Difference?
Base64 and Base64URL encode the same bytes but use different alphabets. Here's why JWTs and URLs use the URL-safe variant, and how to convert between them.