Google Cloud IAP Offers a Low-Cost Way to Lock Down Staging Environments

·1 views

Staging environments are often publicly accessible by default, creating security risks such as search engine indexing or unauthorized access by former employees. Google Cloud's Identity-Aware Proxy (IAP) addresses this by adding an authentication check at the load balancer level, requiring a verified Google identity before any request reaches the backend. Setting it up involves enabling the IAP toggle on a backend service and granting access to specific users or groups via IAM roles. The solution works seamlessly for browser-based clients, which are redirected through a Google sign-in flow and issued a session cookie. However, non-browser clients such as mobile apps, CI pipelines, or scripts require a different approach, using bearer tokens or service-account credentials instead of the standard OAuth redirect.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds self-hosted X/Twitter video downloader in 463 lines of Node.js

A developer frustrated with ad-heavy, privacy-questionable third-party sites built a self-hosted web app to download X/Twitter videos. The tool, called xdl, uses yt-dlp as its primary extraction backend and FxTwitter API as a fallback, requiring zero npm dependencies beyond Node.js and ffmpeg. Users can paste a tweet link to get a video preview, select quality from 270p to 720p or higher, and download an MP4 directly to their device. For 1080p content, which X serves only as HLS streams, the server merges video and audio server-side via ffmpeg before delivering the file. The project is open source under the MIT license and is designed to run on a personal server or laptop, keeping all data private and off third-party infrastructure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Base CV, Tailored Per Job: A Smarter Approach to Job Applications

A productivity tool called CVSet has been developed to address the inefficiency of rewriting CVs from scratch for every job application. The platform separates a CV into two layers — fixed facts and adjustable presentation — allowing users to maintain one strong base document that is tailored, not rewritten, for each role. Tailoring is limited to reordering, rewording, resurfacing, and trimming existing content, with the tool explicitly prohibited from inventing skills or achievements. CVSet scores the base CV across nine dimensions, including metrics, readability, and ATS keywords, from four perspectives including recruiters and algorithms. The approach aims to save time and maintain accuracy, ensuring that improvements made to the base CV benefit all future applications simultaneously.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Linux SGID Bit Enables Secure Group Collaboration in Shared Directories

A collaborative directory /sysops/data was configured on App Server 2 in the Stratos Datacenter to meet the Nautilus team's strict data access requirements. The directory is owned by the sysops group, with permissions set to 770, granting full read, write, and execute access only to the owning user and group while blocking all others. A key challenge in shared Linux directories is that files created by different users default to their own primary group, preventing teammates from accessing each other's work. To solve this, the SGID (Set Group ID) bit was applied to the directory, ensuring all newly created files automatically inherit the sysops group ownership regardless of who creates them. This setup allows all sysops team members to collaborate seamlessly without manual permission changes, while keeping data inaccessible to outside users or groups.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Using 'new HttpClient()' in C# Can Exhaust Sockets in Production

Repeatedly instantiating HttpClient with a 'using' statement in C# causes socket exhaustion because disposed sockets enter a TIME_WAIT state for up to 240 seconds, depleting available ports under high load. A single Windows machine offers roughly 16,000 ephemeral ports, meaning an app handling 100 requests per second can hit exhaustion in under three minutes. Microsoft introduced IHttpClientFactory in .NET Core 2.1 to address this by pooling and reusing HttpMessageHandler instances while supporting proper DNS rotation. Developers can register named or typed clients via dependency injection, allowing pre-configured, reusable HttpClient instances across services. Connection handlers are recycled every two minutes by default, though this interval is configurable with caution around long-lived DNS caching issues.

0 comments Read more at DEV Community