The latest articles on DEV Community by Tom (@human2001). https://dev.to/human2001 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3877711%2F254efe6e-2a59-4512-a02a-ce2b091f9b43.png https://dev.to/human2001 en Tom Sun, 19 Apr 2026 15:19:24 +0000 https://dev.to/human2001/server-builds-wallet-signs-webhooks-confirm-a-non-custodial-web3-checkout-pattern-with-solana-29ah https://dev.to/human2001/server-builds-wallet-signs-webhooks-confirm-a-non-custodial-web3-checkout-pattern-with-solana-29ah <p>I've been building a Solana checkout flow. The core challenge: the server needs to control the terms of every payment — the amount, the recipient, the audit trail — without ever holding a private key.</p> <p>This post documents the pattern I landed on:</p> <ul> <li>Checkout session with TTL and CSRF protection</li> <li>Atomic token invalidation to prevent TOCTOU race conditions</li> <li>A server-side pending record (similar to Stripe's Payment Intent) written before the wallet is ever involved</li> <li>Webhook authentication and idempotent confirmation</li> </ul> <p>The server constructs the unsigned transaction, the wallet signs it, and confirmation happens via webhook rather than client reporting. Solana-specific in implementation but the architecture applies to any chain.</p> <p>Already got a good question in the HN thread about meta-transactions and commit-reveal schemes.</p> <p>Full post: <a href="https://blauenlabs.com/blog/web3-checkout-pattern/" rel="noopener noreferrer">https://blauenlabs.com/blog/web3-checkout-pattern/</a><br> HN discussion: <a href="https://news.ycombinator.com/item?id=47821168" rel="noopener noreferrer">https://news.ycombinator.com/item?id=47821168</a></p> <p>Happy to discuss the tradeoffs.</p> web3 solana webdev security Tom Tue, 14 Apr 2026 03:56:02 +0000 https://dev.to/human2001/web-app-security-a-developers-guide-to-content-security-policy-csp-4mmc https://dev.to/human2001/web-app-security-a-developers-guide-to-content-security-policy-csp-4mmc <p>What a CSP is, why you need one, and how to audit yours — including a real example of a violation we caught in the wild.</p> <div class="crayons-card c-embed text-styles text-styles--secondary"> <div class="c-embed__content"> <div class="c-embed__body flex items-center justify-between"> <a href="https://blauenlabs.com/blog/content-security-policy/" rel="noopener noreferrer" class="c-link fw-bold flex items-center"> <span class="mr-2">blauenlabs.com</span> </a> </div> </div> </div> webdev security cybersecurity