The AMQP Property the Broker Vetoed
A caller-identity feature added at 21:10, disabled at 22:31 and deleted four days later - and the residue is a gateway that carries no caller identity into a message at all.
Archive
Every article
Newest first, grouped by year. Search or filter by topic.
- 556 articles
- 4 matching
All
.NET
AI Engineering
Architecture
Azure & DevOps
Data Warehousing
Engineering Practice
Microservices
Web APIs
identity ×
One Guid, Five Customers
A single Guid minted at sign-up becomes a user, a customer, a payments customer, a wallet owner and a saga id - four Postgres schemas, five field names, zero foreign keys and nothing that declares the equality.
Identity in Fifteen Files
Pacco's Identity service fits its whole auth machinery - JWT issuance, a refresh-token aggregate, Redis deny-list revocation - in about fifteen files, and most of them are right. The three that aren't teach more - a mapper bug that leaves 202 callers polling forever, a dead password check, and a refresh token that never rotates.
Security Theatre and Security Reality
Pacco names every control - JWT validation, a Vault, a log scrub-list, admin-only routes - and then a sign-up body chooses its own role, the signing key lives in every repo, Vault is off in Docker and anonymous callers pass every ownership check. A governance read of which shortcuts survive copy-paste.