How a Spring Backend Eliminated Per-Request Auth0 /userinfo API Calls

·1 views

A development team discovered their Spring backend was making repeated HTTP calls to Auth0's /userinfo endpoint on nearly every request because the access token lacked an email claim by default. The fallback mechanism relied on Redis caching, but cache misses during cold starts, deploys, and new user logins still triggered live Auth0 API calls, creating a performance and availability risk. Multiplied across the user base and token rotations, this resulted in a significant unintended dependency on Auth0's response times. The team resolved the issue by using Auth0's Post-Login Actions to embed required user claims — such as email, name, and picture — directly into the access token at issuance time. This eliminated the need for any /userinfo lookup at request time, making the backend self-sufficient with the data carried in the token itself.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer merges 14 PRs in 24 hours, estimates equivalent to 2 months of senior engineering

A developer using AI assistance merged 14 pull requests across two open-source projects, the Waaseyaa Framework and Sheg, within approximately 24 hours. The work covered database migration safety, authorization fixes, embed lifecycle issues, serialization, and sitemap handling, among other backend concerns. Beyond the merges, the developer identified and patched several latent defects including authorization gaps, swallowed test failures, a deadlocking subprocess, and an unsafe build cache. A 358-site SQLite coupling inventory across 108 files was also produced as groundwork for future database compatibility. The developer estimates the same scope of work would take a single experienced senior engineer roughly 6 to 10 weeks, or around 240 to 400 hours, under conventional conditions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tutorial: How to Build Privacy-Safe One-Shot Visual Context for AI Voice Companions

A developer tutorial published on DEV Community outlines a TypeScript-based approach to handling visual input in AI voice companions built with Tencent RTC and Google's Gemini model. The core problem addressed is that continuously streaming camera frames to an AI model raises privacy concerns, increases data costs, and can cause the model to respond based on outdated visuals. The proposed solution uses a 'one-shot' visual context system, where the user deliberately shares a single frame that can only be consumed by one voice turn before expiring. The architecture keeps components — microphone input, speech recognition, visual snapshot approval, and model interaction — strictly separated to avoid silent privacy decisions being made on the user's behalf. The tutorial also warns developers not to assume multimodal support based on voice connectivity alone, and to ensure text-only model routes fail explicitly rather than discarding images without notice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with existing online tools, such as JWT decoders and regex testers, which can log or transmit user data to remote servers. Every operation in Antigravity Tools runs locally in the browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The project is available for free at antigravitytools.app and was built without npm packages, bundlers, or tracking cookies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why LLMs in Production AI Systems Need a Data Sanitization Layer Before RAG

A developer working on Agentic AI for production support has raised concerns about excessive sensitive data being sent to large language models. The author argues that information such as hostnames, API keys, authorization tokens, and file paths is often unnecessary for LLMs to resolve incidents like disk space errors. A key insight highlighted is that RAG alone is not a security boundary, since raw data passes through embedding models before reaching a vector database, meaning sanitization must occur earlier in the pipeline. The proposed architecture adds a clean-and-validate layer before both the embedding stage and the final LLM call, covering retrieval queries and observability logs as well. The author concludes that AI governance should be enforced through system design rather than policy documents alone.

0 comments Read more at DEV Community