Secure SMS OTP Login: Rate Limits, Lockouts, and Replay Defense

·1 views

An SMS provider can deliver and verify a code, but it cannot see enough of your application to decide whether a request is abusive. Short answer: design a secure SMS OTP login flow with per-user, per-IP, and per-device limits in front of every send; give each challenge a short expiry and an attempt ceiling; consume it exactly once; temporarily lock repeated failures; and enforce country policy before spending a send. Provider selection comes after those controls, not before them. For a healthtech marketplace notifying a seller about a new order, keep that notification outside the login challen

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why We Left SleekFlow After Its AI Agent Started Confidently Lying to Customers

The problem wasn’t the AI agent talking fast. It was the AI agent talking fast and wrong — with no log showing why. Booking.com lost €1,400 after their AI chatbot confidently told a customer to pay by bank transfer. No “maybe,” no “check this”—just a flat wrong answer. The money was gone before anyone re-read the thread.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Comparing Prometheus Pull and Push API Custom Metrics for Small SaaS Node.js

Short answer: start with a push-style metrics API when a small Node.js team needs to judge a flagged property-pricing rule from a few application-level signals. Choose Prometheus plus Grafana when scrape-based infrastructure coverage, Kubernetes integrations, or sophisticated querying matter more than setup weight. The deciding variable is signal quality versus noise, not dashboard polish. For a solo founder, Infrai's native surface also exposes consistent per-call cost, vendor, and latency metadata. Those fields make the monitoring path's own overhead visible while the pricing experiment runs

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Parse a TikTok Profile URL Without Keeping Tracking Parameters

People paste profile links from chats, browsers, and share sheets. Those links can carry query parameters that are irrelevant to identifying the account. A small parser should extract a handle from the profile path, reject unrelated hosts, and leave the original URL out of the lookup key. I built TikStories to accept a public TikTok handle or profile URL and show currently active public Stories. The example below is a standalone parsing exercise, not a copy of the site's internal code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Go Web Frameworks in 2026: net/http, chi, Gin, Echo, Fiber Compared

Go ships a production-capable HTTP server in its standard library, and since Go 1.22 the built-in router handles method matching and path parameters on its own. The framework question has narrowed, not disappeared. Five stacks cover almost every Go backend decision in 2026: the standard library's net/http, chi, Gin, Echo, and Fiber. Each takes a different position on the same tradeoff — what the library gives you versus what you owe it in dependencies, conventions, and ecosystem compatibility. This article compares them on routing power, handler ergonomics, middleware, and measured performance

0 comments Read more at DEV Community