Programming, architecture, application development, message queues, middleware, databases, containerization, big data, image processing, machine learning, AI, personal growth.
This article explains what server‑side request forgery (SSRF) is, describes its impact, common attack vectors such as targeting the server itself or internal services, outlines bypass techniques for blacklist and whitelist filters, and discusses blind SSRF detection using out‑of‑band methods.
This article explains what directory (path) traversal is, demonstrates how attackers can read or write arbitrary files on a server by manipulating file‑path parameters, outlines common bypass techniques, and provides concrete defensive coding practices to mitigate the vulnerability.
This article explains the fundamentals of Cross‑Origin Resource Sharing (CORS) and the Same‑Origin Policy, illustrates common misconfigurations and attack scenarios such as origin reflection, null origin whitelisting, and TLS downgrade, and provides best‑practice mitigation techniques for secure web development.
This article explains the OAuth 2.0 protocol, describes its four grant types, focuses on the Authorization Code and Implicit flows, outlines the involved roles, token types, client registration steps, and provides detailed request‑response examples for both grant types.
This article explains the MySQL client‑server communication protocol, detailing the connection phase—including handshake, authentication, and packet structure—as well as the replication process, covering registration as a slave, binlog streaming, and the various binlog event types and their formats.
This article outlines five practical methods for synchronizing MySQL data to external systems such as Elasticsearch, Redis, and message queues, covering business‑layer hooks, middleware integration, scheduled tasks using updated_at, binlog parsing with ROW format, and handling mixed or statement binlog formats, plus open‑source tools.
Elasticsearch provides two search types—query_then_fetch (default) and dfs_query_then_fetch—each involving a multi-step process where the client node distributes queries to relevant shards, shards execute searches using local or global term frequencies, aggregate results, and retrieve full documents, with noted trade‑offs.
This article explains how to separate Elasticsearch DSL queries from application code by defining reusable search templates with Mustache placeholders, managing them via the scripts API, and rendering them with parameters to produce flexible, maintainable search requests.
This article outlines a request log analysis system that records core request fields, adds proxy‑related data, derives IP‑based ASN and geographic information, parses user‑agent details, and provides comprehensive metrics such as PV/QPS, UV, traffic, latency, status monitoring, and business‑specific insights, all visualized via an ELK‑Kafka architecture.
Elasticsearch calculates a relevance score for each document, but using the function_score query you can customize this scoring by combining the original query_score with a user-defined func_score through various functions such as weight, random_score, field_value_factor, decay_function, and script_score, allowing flexible ranking based on business needs.
