Md. Shafikul Islam
2 min read
Refresh-token rotation, explained without hand-waving
Short-lived access tokens, rotating refresh tokens and reuse detection — how the pieces fit together in a Node.js API.
Blog
Notes on backend engineering, SaaS architecture and building for the web.
2 posts tagged #security Clear
Md. Shafikul Islam
2 min read
RBAC that scales past “admin” and “user”
Model permissions as scopes, group them into roles, and check them in one place — a structure that survives the tenth new feature.