Blog

Perspectivas sobre la construcción de SaaS a escala

Building SaaS Auth from Scratch

Authentication is the foundation of any SaaS application. In this post, we'll walk through how AtendePraMim implements session-based auth with iron-session, 2FA via TOTP, and magic links. We use iron-session with AES-256 encrypted HttpOnly cookies. No JWTs exposed to the browser. TOTP-based 2FA adds a second layer. The user scans a QR code with their…

ALAlexandre Awadallak

artículoguías

11 abr

Primeros Pasos con AtendePraMim

Bienvenido a AtendePraMim — el boilerplate SaaS full-stack en Next.js. Autenticación — Correo/contraseña, magic links, login social, 2FA Multi-organización — Equipos, miembros, invitaciones, roles Facturación — Integración Stripe, planes, cuotas, créditos Y más — Notificaciones, webhooks, servidor OAuth2, casos de soporte Clona el repositorio Copia…

ALAlexandre Awadallak

artículoengineering

9 abr

Scaling Your SaaS with Redis

Redis is the Swiss Army knife of SaaS infrastructure. AtendePraMim uses it for four distinct purposes. Iron-session encrypts the session into the cookie itself, so Redis isn't needed for session data. But we use Redis to track active sessions for revocation. Sliding window rate limiting with INCR and PEXPIRE. Each endpoint has its own key prefix and limits.…

ALAlexandre Awadallak

artículoengineering

25 mar

Webhook signing with HMAC

Webhooks are inbound HTTP requests from third parties. Without verification, anyone on the internet can POST to your webhook endpoint and trigger work. HMAC signing is how you verify the sender. When a provider sends a webhook, it computes an HMAC-SHA256 signature over the raw request body using a shared secret, then includes the result in a header…

ALAlexandre Awadallak

artículoengineering

20 mar

Rate limiting strategies that actually scale

Rate limiting is deceptively simple. A naive counter-per-minute works in your test suite and breaks in production the first time a user opens ten tabs at once. A fixed window resets on the hour. That lets a single client burn their entire quota at 11:59 and then do it again at 12:00 — an effective 2x limit. Sliding windows smooth this by weighting the…

ALAlexandre Awadallak

artículoengineering

15 mar

Multi-tenant database design

Most SaaS products pick their multi-tenancy model once and live with it forever. The migration cost later is so high that teams build entire companies around the constraints of a decision they made in their first sprint. Every row carries orgid. One database, one schema, one set of connections. Cheap to operate and dead simple until you need a row-level…

ALAlexandre Awadallak

artículoengineering

10 mar

Background jobs with BullMQ

Most application bugs don't live in your API handlers. They live in the long tail of "send this email later" and "charge this card tomorrow" — background jobs where failures are silent and retries compound. Redis-backed, TypeScript-first, batteries included. Built-in delayed jobs, retries with exponential backoff, a dead-letter queue, and a clean API for…

ALAlexandre Awadallak

artículoengineering

5 mar

Stripe webhooks and idempotency

Stripe will retry every webhook at least once. Network blips, slow processing, a bad 5xx — all of them trigger another delivery. If you double-grant credits or double-send the "Welcome" email because two copies of the same event arrived, that's your bug, not Stripe's. event.id starts with evt and never changes across retries. Store it. On receipt, check…

ALAlexandre Awadallak

artículosecurity

28 feb

Preventing SSRF in file uploads

SSRF — Server-Side Request Forgery — is the class of bug where your server makes an HTTP request on behalf of a user to a URL the user controls. The classic case: a profile-picture import feature that takes a URL and fetches the image. The attacker gives you http://169.254.169.254/ and suddenly your server is handing the cloud metadata endpoint to the…

ALAlexandre Awadallak

Boletín

Mantente al día

Recibe nuevas publicaciones y entradas del changelog por correo o RSS.

RSSRSS del changelog