Web Developer Blog
A resource for web developers exploring modern technologies, best practices, and practical solutions.
Configuring identity-only OAuth requests in Waaseyaa
How Waaseyaa’s oauth-provider package added optional, additive configuration so a consumer that only needs a stable Google or GitHub identity can skip the email lookup, the forced consent prompt, and the offline refresh-token grant.
Claude Code and Codex skills are directories, not files
Why Claude Code and Codex discover agent skills as a directory containing SKILL.md, not a flat markdown file, and what silently breaks when an installer gets that wrong.
Host-bound session and CSRF cookies in Waaseyaa
How Waaseyaa’s SessionCookiePolicy enforces the __Host- cookie prefix’s four constraints for both the session cookie and the CSRF double-submit cookie, and rejects misconfiguration at boot instead of failing silently in the browser.
Fixing a metadata collision bug in Waaseyaa's file repository
How Waaseyaa’s LocalFileRepository silently collided metadata for different stream-wrapper URIs that shared a trailing path segment, and the fix that preserves full URI identity plus atomic writes and a reconciliation tool.
Building a conformant stdio MCP server in PHP
The wire-level rules that make a stdio MCP server correct in PHP - one writer to stdout, a bounded read with no natural limit, and a handshake that tells old clients from new ones.
A loopback-only proxy for prototyping northway's feed reader
How northway’s browser prototype keeps its API key off client JavaScript with a loopback-only Node proxy, before any of it reaches the production Pi build.
Fixing a cache:clear command that couldn't run and couldn't be trusted
How Waaseyaa’s cache:clear command couldn’t even run in production, and how a hardcoded bin list quietly reported success while clearing the wrong cache entirely.
Fixing a silent message-drop bug in Waaseyaa's queue worker
How Waaseyaa’s queue worker silently acknowledged persistent messages with no matching handler, and the fail-closed fix that routes them through retry and the failed-job repository instead.
Fixing a schema-mutating access check in Waaseyaa's taxonomy package
How Waaseyaa’s taxonomy package let ordinary request traffic ALTER a table to add a foreign key, and the fix that moved that DDL exclusively into coordinated schema sync.
Stop letting a failing audit logger crash requests that already succeeded
Why a throwing audit logger in Waaseyaa’s MCP endpoint could crash a request after its outcome was already decided, and the containment pattern that fixed it.