Developer builds production-ready Helpdesk API in Go using only standard library

·1 views

A software developer has published a fully functional Helpdesk REST API built in Go without any web frameworks, relying solely on the standard library plus a SQLite driver and a JWT library. The project supports two user roles — customers and agents — with features including ticket management, status and priority tracking, JWT-based authentication, and role-based permissions. Password hashing follows OWASP recommendations using PBKDF2-SHA256, and security details such as identical error messages for wrong email or password help prevent user enumeration attacks. Routing is handled by Go 1.22's enhanced http.ServeMux, which the developer argues eliminates the need for third-party router libraries. The full source code is publicly available on GitHub and includes automated tests and a Docker image for deployment.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How unprepared management derailed a SaaS project and stalled a developer's career

A developer identified in the account as Maria spent seven months building a solid frontend from scratch for a SaaS overhaul at a small tech firm, only to have her work discarded when a newly hired senior developer convinced management to adopt a purchased template instead. The decision was made based on seniority rather than technical merit, setting a pattern where proven contributions were overridden without structured debate. When a core technology update caused the template to break four months before launch, neither the senior developer nor the team could resolve the incompatibility, forcing the project to be rebuilt on a third template. A project originally scoped for under one year stretched beyond two years with no clear completion date, accumulating technical debt at each restart. The account highlights how amateur project management — treating technology choices and deadlines as unrelated decisions — ultimately burdens frontline developers while shielding decision-makers from accountability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stored XSS Flaw Found in Next.js Demo Store via Malicious SVG Upload

A stored cross-site scripting (XSS) vulnerability was discovered in OopsSec Store, a deliberately vulnerable Next.js e-commerce app used for security training. An attacker with admin access could upload a malicious SVG file as a product image, embedding JavaScript that executes automatically for every visitor who views the product page. The flaw existed because the server trusted the client-supplied Content-Type header without inspecting actual file contents, and the app rendered SVGs using an img tag that allowed script execution. The vulnerability affected multiple endpoints, including the product page, admin preview, and the direct file URL. Recommended fixes include magic-byte file inspection, server-side SVG sanitization with DOMPurify, and strict Content-Security-Policy headers on the uploads directory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

broot's whale-spotting mode and staging area streamline disk cleanup in one pass

When disks fill up, engineers typically rely on repetitive du and rm commands that only show flat directory totals, requiring deletions one folder at a time. The broot file manager offers an alternative workflow using its whale-spotting mode, launched with br -w, which sorts files and directories by size in an interactive tree. Users can press Ctrl-G on any file to add it to a staging panel, building a review set and seeing the total space to be freed before deleting anything. Once the desired files are collected, switching focus to the staging panel with Ctrl-Right and typing :rm removes the entire set in a single step. The workflow reduces disk cleanup to three stages — list, review, and delete — replacing the traditional back-and-forth loop with a single interactive session.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Built AI-Coded Orienteering Analyzer to Track Daughter's Race Performance

A developer created a web portal to analyze his daughter's orienteering competition results in detail, with all the source code written entirely by an AI agent. The tool combines three data sources — a georeferenced scanned course map, a GPS track split into individual leg segments, and an official race protocol — into a single analytical model. Georeferencing is achieved by manually marking reference points on the scanned map and a base map, allowing GPS coordinates to be assigned to each control point. The portal automatically cuts a GPS track into splits at each checkpoint and imports race protocols from multiple formats including HTML, JSON, and PDF. The goal is to identify exactly where time is lost on each leg and compare performance against other competitors and an ideal benchmark.

0 comments Read more at DEV Community