Part of the Refresh Token Design series. The Question the Last Post Left Open A refresh arrives carrying a device proof that does not verify. Two things can produce it, and the request looks identical either way. A browser that lost its key and generated a new one, which is ordinary and frequent. Somebody holding a copy of the refresh token, who cannot sign because the key never left the machine it was made on. ...
Part of the Refresh Token Design series. The Problem With Single Use Single use refresh tokens are the standard advice and the advice is right. A refresh token that works twice is a refresh token somebody can steal and use behind you. The trouble is the failure mode when a response goes missing. A client sends its refresh token. The server rotates, writes the new pair, and answers. The answer never arrives, because the tunnel dropped, the phone changed cell, the laptop lid closed. The client still holds the old token, and the old token is now spent. It retries, gets refused, and the person is looking at a login screen because of one lost packet. ...
What The n8n instance on our production server stopped processing work. One workflow, a telemetry collector that receives a stream of concurrent webhook calls, had overloaded the database and taken the whole instance down with it. The numbers when we looked: 300+ executions stuck in running state 346 executions in new state that never started 161 executions failed with LockAcquireTimeoutError The UI was slow enough to be unusable The error behind all of it: ...
Part of the Sanchayam series. Why Friday Portfolio performance is tracked week by week, not day by day. Daily snapshots would generate a large amount of data for a view that is displayed weekly at best. Friday is chosen because Indian markets close at 3:30 PM IST on Friday. The snapshot cron runs at 11:00 AM UTC, which is 4:30 PM IST - 30 minutes after market close, giving price feeds time to settle. ...
Part of the Sanchayam series. Why FIFO FIFO (first in, first out) is the standard cost basis method for Indian equities and mutual funds for tax purposes. When you sell shares, the oldest lots you bought are assumed to be the ones sold first. The cost basis of those oldest lots determines your taxable gain. Sanchayam implements FIFO at sell time: when a sell lot is recorded, the backend walks the buy lots in chronological order, consuming them until the sell quantity is satisfied, and computes the aggregate cost. ...