fpereiro

backendlore

OPEN SOURCE2020–2023

fpereiro / backendlore

backendlore

How I write backends

Explore on GitHub Read Hacker News discussions

8Distinct people

13Mentions

1Explicit recommenders

5.4KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

How I write backends

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

As a less experienced web developer, i found "How I write backends"[1] very enlightening and I recommend it to all my peers when we discuss useful resources. 1.…

codeDruid used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year13 dated mentions

Observed mentions: 2020-01-21 13:01:18 UTC to 2023-10-18 23:48:22 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	9	3	6
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	1	0	1
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	2	0	2
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	1	0	1

What Hacker News says

13 sources

vlod·Oct 18, 2023

Sure it's not for everyone. I learnt a lot doing cash strapped startups where there wasn't a devops person. AWS can get expensive, especially when you start using more and more services (lambda,dynamodb,rds,elasticache etc) although it can be easily scaled. Note, you probably shouldn't do it by hand (setting up your own servers). You'd use Ansible/Terraform. For those that are interested but not quite ready, here's a great article [0]. [0] https://github.com/fpereiro/backendlore.

In Ask HN: Where to Host a FastAPI App

swah·May 12, 2022

Reminds me of https://github.com/fpereiro/backendlore

In I'm all-in on server-side SQLite

Zababa·Feb 15, 2022

A good example of ASCII diagrams: https://github.com/fpereiro/backendlore

In Include diagrams in your Markdown files with Mermaid

remote-dev·Dec 3, 2021

I have found this to be useful: https://github.com/fpereiro/backendlore It is more about writing backends generally, but in it he uses Redis as a primary database and walks through durability and scalability.

In How to build a HackerNews Clone using Redis

jamessb·Aug 2, 2020

Was it "How I write backends" [1] (previously posted to HN [2])? [1]: https://github.com/fpereiro/backendlore [2]: https://news.ycombinator.com/item?id=22106482

In Ask HN: GitHub gist about web architecture

codeDruid·Jul 21, 2020Recommendation phrase

As a less experienced web developer, i found "How I write backends"[1] very enlightening and I recommend it to all my peers when we discuss useful resources. 1. https://github.com/fpereiro/backendlore

In Essays on programming I think about a lot

smilebot·May 19, 2020Submission

Ask HN: What are some interesting links in your bookmarks folder?

I found myself going through my old bookmarks and found some interesting links that I wanted to read but never got to. Here's a link I uncovered recently that I found to be informative. https://github.com/fpereiro/backendlore.

3 points · Open discussion

fpereiro·Feb 7, 2020Submission

Ask HN: Acceptable CSRF Token Lifecycle?

Hi HN! Question for those with experience writing and/or auditing the auth flows of a web application. I recently decided to move my session cookies to HttpOnly, to mitigate the damage of a XSS attack. To prevent CSRF, I was sending said session cookie as an extra field with every POST request (double submit cookie pattern: https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65…). Now that the session is not readable from javascript, I need to create a separate CSRF token. Based on great feedback from the community (see https://news.ycombinator.com/item?id=22209588 and https://github.com/fpereiro/backendlore/issues/12), I'm considering the following approach: - On every successful login, create a new secret/token (using the same crypto mechanism I use to create the session secret, but a different secre

Read the rest

t altogether) and store it on the database, tied to the session itself. Set both the session and the CSRF token to expire at the same time. - Every time I get a request with a valid session, renew the life of both the session AND the associated CSRF token. - On every successful login, return the CSRF token in the body so that it can be read by client-side javascript. - Set up an endpoint to retrieve the associated CSRF token for its session. If no session is present (or the session has expired), return a 403 code. This also solves the problem of letting the client-side app know whether the user is logged in or not (I would hit this GET /csrf endpoint when the javascript loads to determine whether there's a valid session available). My understanding is that, as long as the browser supports Same-Origin Policy (https://en.wikipedia.org/wiki/Same-origin_policy), a CSRF attacker could not submit a GET request to my server and obtain the result. If you see any security issues in the above scheme - or if you use a similar scheme and know it to be secure - please let me know. Thank you very much for your feedback!

1 points · Open discussion

fpereiro·Jan 30, 2020

I added recently a bit more of detail in the document explaining when I would use redis (and when I wouldn't) to build production systems, here: https://github.com/fpereiro/backendlore#redis . For most applications, I think it's a viable alternative. Modeling data with redis is great fun, and quite different to the relational paradigm. I hope you enjoy a lot your upcoming project!

In How I write back ends

fpereiro·Jan 22, 2020

I added a few more notes on when/why to use Redis and when to use something else: https://github.com/fpereiro/backendlore#redis . Redis can take you surprisingly far as a general purpose database. I prefer to use either Redis or a relational database, but I'm in no position to tell you that you should do that too, particularly if MongoDB works well for you.

In How I write back ends

fpereiro·Jan 22, 2020

Please see https://github.com/fpereiro/backendlore/issues/5 .

In How I write back ends

fpereiro·Jan 22, 2020

Thank you for your suggestion about using samesite=strict! I'll look into it a bit more - the only downside I see is support for older browsers, which is a personal vice I can't kick. If I see that there's no elegant CSRF solution, this will probably be my fire escape. Thank you for that! I added more info in the document regarding cookie/session management, particularly its expiry (https://github.com/fpereiro/backendlore#identity--security). The approach I take is to make cookies last until the server says so. I'm very curious as to how you use cookies with varying expiration times and would love to know more if you have the time.

In How I write back ends

fpereiro·Jan 21, 2020Submission

How I write back ends

521 points · Open discussion