DEV Community: janmejay swain

Fixing JWT Session Validation Issues with Redis

janmejay swain — Mon, 01 Sep 2025 07:49:14 +0000

When building secure APIs, JWT (JSON Web Token) is one of the most popular authentication methods. It’s lightweight, stateless, and easy to integrate. But JWT has one common problem: once a token is issued, it remains valid until it expires—even if the user logs out.

This creates a security gap where someone with access to the token can still make requests until it naturally expires.

Let’s explore how to fix this using Redis.

The Problem: Token Still Valid After Logout

JWT works without server-side session tracking. Once a token is signed, the server doesn’t store it—validation is done by checking the signature.

That means:

If a user logs out, the token doesn’t automatically become invalid.
If an attacker steals or copies the token, they can use it until expiration.

The Solution: Using Redis as a Blacklist

To solve this, we can introduce a token blacklist mechanism with Redis.

Here’s how it works:

When the user logs out, store the token in Redis with an expiration time matching the JWT expiry.
On every API request, check if the token exists in Redis.

If yes → reject the request (Unauthorized or Illegal Access).
If no → proceed with normal JWT validation.

This way, even if someone has a stolen token, it won’t work after the user logs out.

Benefits of This Approach

Immediate logout → Users are logged out instantly, not just after JWT expiry.

Extra security → Protects against token theft and replay attacks.

*Scalable *→ Redis is fast and works well with distributed systems.

Conclusion

JWT is powerful, but without proper logout handling, it can leave your application vulnerable. By integrating Redis as a blacklist, you can ensure better session control and stronger security for your applications.

Life as a Software Engineer Today: Balancing Work, Learning, and Life

janmejay swain — Sun, 31 Aug 2025 05:39:37 +0000

Being a software engineer in today’s world is both rewarding and demanding. With technology evolving at lightning speed, every developer faces the constant challenge of staying updated while managing work and personal life. Let’s dive into how work-life balance, learning curves, and career growth intersect in the life of a modern software engineer.

The Ever-Changing Learning Curve

Technology never stands still. New programming languages, frameworks, tools, and best practices emerge every year. For a software engineer, learning isn’t just part of the job—it is the job.

From mastering a new frontend framework to understanding cloud infrastructure, engineers often face steep learning curves. Continuous learning requires curiosity, persistence, and the ability to adapt. While it can feel overwhelming at times, embracing the learning process helps engineers stay relevant and grow in their careers.

Work-Life Balance in a Remote-First World

Remote work and flexible hours have become standard in many tech companies. While this flexibility is a blessing, it also comes with challenges. Work can easily spill into personal time, and boundaries between “office hours” and downtime blur.

Maintaining work-life balance requires conscious effort:
Set clear working hours and stick to them.
Take short breaks to refresh your mind during long coding sessions.
Prioritize tasks to avoid burnout while staying productive.
Make time for hobbies, exercise, and family.

A healthy balance improves not only mental and physical health but also productivity and creativity at work.

Career Growth and Personal Development

A software engineer’s career isn’t just about coding—it’s also about problem-solving, collaboration, and communication. Engineers who invest in personal development—learning soft skills, mentoring others, and exploring different domains—tend to have more sustainable and fulfilling careers.

Remember, growth is incremental. Small, consistent learning—whether it’s reading a technical blog, experimenting with a new library, or contributing to open-source—adds up over time and keeps your skills sharp.

Conclusion

Life as a software engineer today is a careful balancing act. Between continuous learning, demanding projects, and personal commitments, it’s easy to feel stretched. But by embracing curiosity, setting boundaries, and focusing on holistic growth, software engineers can thrive both professionally and personally.

The journey is challenging, but it’s also incredibly rewarding. After all, in a field that constantly evolves, staying adaptable and maintaining balance is the ultimate skill.

🔐 Understanding Checksums in Data Transmission with a Real-World API Example

janmejay swain — Sat, 30 Aug 2025 17:42:36 +0000

📌 Introduction

In today’s world of fast-moving data—whether it’s a file download, a payment API call, or a network packet—ensuring that the information you send is the same as what the receiver gets is critical.

Data can get corrupted during transmission due to network glitches, software bugs, or even malicious tampering.

So how do we guarantee data integrity? 👉 The answer is Checksums.

✅ What is a Checksum?
A checksum is a unique value (a “digital fingerprint”) generated from a block of data using an algorithm such as MD5, SHA-256, or CRC32.

If the data remains unchanged → The checksum stays the same.
If the data changes (even by one character/bit) → The checksum value changes drastically.

This property makes checksums extremely useful in detecting corruption or tampering.

🔑 Common Checksum Algorithms

MD5 (Message Digest 5):

Produces a 128-bit hash.
Fast, widely used, but not cryptographically secure anymore

SHA Family (SHA-1, SHA-256, SHA-512):

Stronger cryptographic security.
SHA-256 is widely used in API calls, SSL, digital signatures.

*CRC32 (Cyclic Redundancy Check): *

Used in networking & file storage.
Very fast, but weaker than SHA/MD5.

🌍 Real-World Example: API Payment Transaction

Let’s say we are sending a payment request from our application to a bank’s API.

Imagine you are working on a payment API call that transmits transaction details from your application to a bank server.

🔹 Step 1: Original Request
Our app sends Request:

{ 
  "amount": 1000, 
  "accountNo": "12345678" 
}

🔹 Without Checksum

You send: { "amount": 1000, "accountNo": "12345678" }
Due to a network glitch or by data manipulation, the data received at the bank becomes: { "amount": 1000000, "accountNo": "12345678" }

👉 The transaction will be processed incorrectly (₹1000000 instead of ₹1000).❌

🔹 With Checksum
We generate a checksum using a secret key (only known to sender & receiver).

Checksum Logic → Defines how the checksum is created (the rule/sequence). The logic behind generating a checksum is decided during development by the governing authority or system architects.

Checksum Key → **The secret ingredient (like AES key) that makes the checksum secure and unique.It adds an **extra layer of security to the checksum process. Without knowing the checksum key, they cannot generate the correct checksum.

In our case checksum logic we used the algorithm SHA-512 for hashing, and below logic :

checksum= amount & accountNo & checksumSecretKey

For our case:

checksumSecretKey : abc897645

1000&12345678&abc897645

Generated checksum:

c26ba3faf94d7fa2cbc9e4ba7c8007863e3640fe2e19259711ef6921a928336a
8b1c96da9830205cd7d7a18ac78f8200493c1aa3ce37f6f49f4d80a13e79408e

Final API Request
We attach the checksum to the payload:

{ 
  "amount": 1000, 
  "accountNo": "12345678", 
  "checksum": "c26ba3faf94d7fa2cbc9e4ba7c8007863e3640fe2e19259711ef6921a928336a8b1c96da9830205cd7d7a18ac78f8200493c1aa3ce37f6f49f4d80a13e79408e" 
}

When the bank or receiver receives the request:

It recalculates the checksum using the same logic.
If the checksum matches → ✅ Data is intact.
If not → ❌ Reject the request.

🚨 Example of Data Tampering

Suppose an attacker tries to manipulate the request:

{ 
  "amount": 1000000, 
  "accountNo": "12345678", 
  "checksum": "c26ba3faf94d7fa2cbc9e4ba7c8007863e3640fe2e19259711ef6921a928336a8b1c96da9830205cd7d7a18ac78f8200493c1aa3ce37f6f49f4d80a13e79408e" 
}

Here, amount changed from 1000 → 1,000,000. But notice: The checksum attached is still the one generated for the original request (1000).

👉 The bank recalculates checksum with:

1000000&12345678&abc897645

This produces a completely different checksum:

32c8e052cfeebb707fc4bd444c8de4f7115f40eaaee6d07e3312d02352400375
ed91c92a678b99f4418c7700536e92705a8556721ea6eaa277f64aa90b6bb045

Since the checksum doesn’t match the one provided → The API rejects the transaction 🚫.

✔️ This prevents fraud, corruption, or manipulation.

📦 Where Checksums Are Used

File Downloads → Verifying ISO/software installers.
APIs → Payment gateways, telecom, healthcare.
Networking → TCP/UDP/IP packet integrity.
Databases & Storage → Detecting corruption in data blocks.

🏁 Key Takeaways

Checksum = Digital Watchdog of Data Integrity
Even a single-bit change can be caught instantly.
Always pair your API payload with a checksum (or stronger, HMAC).
Protects not only against accidental corruption but also intentional tampering.

✍️ Closing Thought
In the digital world, a single flipped bit can cause financial loss, broken systems, or even security breaches. Checksums act as the silent guardians of data pipelines, ensuring accuracy and trust.

💡 Pro Tip for Engineers: If you’re working in fintech, telecom, or healthcare, never skip checksum or hashing in your API design. A few extra lines of code can prevent millions in damage.

👉 What do you think? Have you ever faced a situation where a checksum saved your system—or where its absence caused issues?

Continuous Feedback with Digma: How to Enhance Your Development in IntelliJ IDEA

janmejay swain — Sat, 30 Aug 2025 13:53:04 +0000

In today's fast-paced software development world, continuous feedback is crucial for building efficient, reliable, and scalable applications. Digma, a plugin for IntelliJ IDEA, takes this concept to the next level by providing real-time insights into your code’s performance, helping developers spot issues, bottlenecks, and regressions without leaving the IDE. Here's a simple guide to understanding and implementing Digma in your workflow.

What is Digma?

Digma is a continuous feedback platform that integrates seamlessly into IntelliJ IDEA. It analyzes your application’s runtime data to highlight performance bottlenecks, slow queries, and other issues that may impact scalability or efficiency. It is especially useful for working with legacy codebases or complex systems, providing real-time feedback to developers as they code.

Some key benefits include:

Identifying bottlenecks and query issues during development.
Providing insights into how your code performs across environments (e.g., development, staging, production).
GitOps integration for easier pull request reviews and feedback loops.

How Digma Works:

Once installed, Digma continuously profiles your code execution using data from tools like OpenTelemetry. This allows it to detect problems in real-time, helping you address performance issues early in the development cycle. You get feedback directly in your IDE, improving both the speed and quality of your code fixes.

How to Set Up Digma in IntelliJ IDEA?

Step-by-Step Installation Guide:

1.Install the Digma Plugin:

Open IntelliJ IDEA and navigate to File > Settings > Plugins.
Search for "Digma Continuous Feedback" in the marketplace and click Install.

*Configure the Plugin: *
Once installed, open the Digma panel from the bottom toolbar of IntelliJ.
Follow the setup instructions to integrate Digma with your project. No code changes are needed, as Digma works with existing logs and telemetry from your application.

3.** Start Coding:**

As you work, Digma will automatically provide feedback, highlighting areas of concern such as slow-running functions, scaling issues, or risky code. This allows you to address these problems in real time.

Analyze the Data:

Digma helps you identify slow queries, bottlenecks, and performance baselines. You can quickly understand what is slowing down your code and make the necessary optimizations.

Example: Fixing a Bottleneck in Your Code

Imagine you’re working on a large project and your team notices performance slowdowns during testing. With Digma, you would:

Run the application locally.
Receive feedback in the IDE that points to a specific function causing the slowdown.
Review the detailed data provided by Digma on execution times and query performance, make necessary adjustments, and immediately see the impact.

The image above illustrates an example of a bottleneck issue.

Why Use Digma?

Real-time insights: Digma acts as a runtime mentor, providing continuous feedback.
Efficiency: Reduces time spent hunting for performance issues, allowing for faster iterations.
Legacy systems: Great for untangling complex, older codebases by providing detailed analytics on forgotten or poorly documented code.

By using Digma, you can streamline your development process, making it easier to write clean, efficient, and performant code.

Final Thoughts :
Digma’s continuous feedback empowers developers to improve their code quality proactively. Whether you’re working on a new project or maintaining a legacy system, this plugin provides the critical insights you need to build better software.

If you haven't tried it yet, Digma is free for local development—so go ahead and integrate it into your IntelliJ setup today!

Sources : Digma Developer Guide , Step up your coding with Continuous Feedback course By Roni Dover