SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

How Node.js Should Handle SMS OTP Cooldowns and Attempt Limits Securely

0
·4 views

A technical guide published on DEV Community outlines best practices for building passwordless phone login systems using Node.js and Express, specifically for gaming storefronts. The core argument is that the backend must own all SMS OTP resend cooldowns, attempt caps, and anti-abuse counters, never trusting the browser or game client to enforce these rules. The recommended design models authentication as a state machine with distinct states — ready, code_sent, verified, expired, and locked — with a database serving as the authoritative source for expiry and counters. Atomic database transactions are emphasized to prevent race conditions where multiple server workers could simultaneously approve a resend and waste SMS send capacity. The guide also warns that client-visible countdowns are purely UX elements, while stored server-side deadlines constitute actual security policy.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

EarthLink Network Builds 18 In-House AI-Driven Products Across Six Business Functions

Japanese tech firm EarthLink Network has developed 18 proprietary software products entirely in-house, grouped across six operational areas: foundation, growth, execution, monitoring, support, and verification. The suite was not designed as a planned product line but evolved organically, with each operational need giving rise to the next tool. Core products include an SSO authentication system, a shared notification platform supporting email, Slack, LINE, and Webhooks, and a secret-distribution service for managing environment credentials across teams. The company's stated goal is to run its entire operation on AI, with human workers focusing on judgment-based tasks while routine work is handled by automated systems. Full product details, screenshots, and localized versions in four languages are maintained on EarthLink Network's official products page at eln.ne.jp/products.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

When passing tests still let a software bug slip through undetected

A developer maintaining qbofile, a browser-based accounting file converter, discovered that green unit tests can mask incorrect logic when both sides of an assertion are generated by the same flawed code. The bug involved converting transaction split amounts from IIF format, used by QuickBooks Desktop, to QIF format, read by Quicken and GnuCash, where a sign convention error would cause both sides of the test equation to flip simultaneously, keeping tests green. Mutation testing confirmed the assertions were wired to the code but could not determine whether the underlying logic was correct. The developer resolved the uncertainty by building a purpose-designed QIF file and importing it into GnuCash, verifying the split totals were accurate — turning a confident assumption into a confirmed measurement. Separately, a real defect was uncovered during the review process, unrelated to signs and involving how IIF payee and memo fields map to QIF's distinct P and M fields.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Shared Responsibility Model: What Cloud Security Falls on You vs. AWS

The AWS Shared Responsibility Model divides cloud security into two distinct domains: AWS secures the underlying infrastructure, while customers are responsible for what they deploy and configure on top of it. AWS covers physical data centers, hardware lifecycle, hypervisor isolation, global network security, and patching of managed services like RDS and S3. Customers are accountable for data encryption, identity and access management, OS patching on IaaS instances, network configuration, and credential management. The boundary between these responsibilities shifts depending on the service model used — IaaS, PaaS, or SaaS — meaning there is no single fixed line applicable to all scenarios. Most real-world cloud security incidents stem not from AWS failures but from customers mistakenly assuming AWS handles tasks that are actually their own responsibility.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer disables semantic cache after tests reveal it returns opposite answers with full confidence

A developer building a regulatory document retrieval system implemented a semantic cache using cosine similarity to avoid redundant model calls, setting a threshold of 0.92 to match near-identical questions. After a colleague challenged the safety of that threshold, a six-day investigation revealed the cache could return answers to questions with opposite meanings — such as 'patients with fever' versus 'patients without fever' — without any warning signal. Testing with 20 handcrafted Spanish administrative question pairs showed the highest adversarial similarity reached 0.9984, while the lowest genuine paraphrase scored only 0.7470. This meant no threshold could safely distinguish opposite-meaning questions from true paraphrases, making the cache fundamentally unsafe for rule-based queries where citation accuracy is critical. The developer disabled the cache by default and published a full write-up, noting that a bad cache hit is more dangerous than a bad search ranking because it bypasses the model entirely and shows no sign of failure.

0 comments Read more at DEV Community