The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Laravel Sanctum SPA Auth Across Subdomains Will Bite You
Sanctum's subdomain cookie auth looks simple until CORS and session config conspire to ruin your day. Here's the config that actually works.
Sanctum's documentation makes subdomain SPA authentication look like a ten-minute job. It is not a ten-minute job. I've set this up across probably a dozen projects now — e-commerce frontends on hitting APIs on , healthcare portals, a real estate dashboard — and every single time there's a moment where the cookie just…
Read the daily →The nginx directive that cuts PHP-FPM overhead in half
One keepalive line in your nginx upstream block and you stop paying TCP handshake tax on every PHP request. Here's why it's off by default and how to tune it.
I've tuned a lot of nginx configs over the years and I kept seeing the same thing: servers handling two or three hundred PHP requests per second with perfectly healthy CPU and memory numbers, but p99 latency sitting higher than it should be. The culprit, more often than not, was sitting right in the upstream block…
Read the daily →Pipedream vs. a webhook relay you own: when trust gets expensive
Pipedream is genuinely good until your payload contains PHI or a signing secret. Here's where I draw the line.
Pipedream is one of those tools I recommend without hesitation — right up until I can't. The line isn't arbitrary. It's the moment a payload contains something I'm not allowed to hand to a third party, or the moment the business logic is complex enough that I'm fighting the platform instead of using it. Let me walk…
Read the daily →MariaDB JSON vs Postgres JSONB: What You Actually Lose
I've run both in production. MariaDB's JSON support is not what Postgres JSONB is, and the gap matters more than MariaDB's docs let on.
I keep running into developers who assume MariaDB's JSON column support is roughly equivalent to Postgres JSONB. It is not. The marketing language is similar, the SQL syntax looks similar, but under the hood they're solving the problem at completely different levels of seriousness. After running both in production…
Read the daily →Finding Your Real Ceiling Before Traffic Does
Reading MariaDB slow query log and PHP-FPM status in isolation gives you half the picture. Here's how I read them together to find the actual breaking point.
The server isn't slow yet, but it will be. That's the only thing I know for certain about any production system I've ever run. The question is whether you find the ceiling on your terms or whether a flash sale, a crawl spike, or a badly-timed cron job finds it for you at 11pm on a Friday. I've done this wrong more…
Read the daily →