AFailure mode
Hiding administrative controls in the frontend is not authorization. Without server-side role enforcement, a normal user can bypass the interface and call privileged endpoints directly.
Selected project01
Tech Blog
A full-stack publishing platform where the interesting work starts after CRUD — server-enforced admin boundaries, comment moderation, input validation, rate limiting, and secure public APIs.
Scope
Product thinking, engineering decisions, system structure, and implementation.
01
The problem
What made this worth solving?
A blog becomes an operational system once untrusted users can authenticate and comment. The engineering work moves beyond post CRUD into authorization, moderation, abuse prevention, validation, and protecting privileged administration capabilities from direct API access.
02
Engineering approach
How the system was shaped.
A React client talks to an Express API backed by MongoDB and Mongoose. JWT authentication protects user and admin routes, while privileged post, user, and comment operations are enforced on the server. Request validation and sanitization guard input boundaries, Helmet adds security headers, rate limiting protects public endpoints, and gzip compression reduces response payloads. Redux Toolkit coordinates client state and React Quill powers authoring.
Technology08 tools
- 01React 18
- 02Node.js
- 03Express
- 04MongoDB
- 05Mongoose
- 06Redux Toolkit
- 07React Quill
- 08JWT
03
Hardest technical problem
The part that needed real engineering.
BResolution
Privileged mutations are protected at the API boundary so authorization is independent of what the browser renders. Validation, sanitization, rate limiting, and security headers provide additional boundaries around the public surface.
04
Outcome
What the work produced.
The application covers the complete publishing lifecycle: discovering and reading posts, authenticated commenting, rich-text authoring, user administration, comment moderation, and content activity from a dedicated admin surface.
05
Looking back
What I would change today.
The project proves a complete production-shaped publishing flow, but moderation contains the strongest domain logic. A future version should go deeper there — moderation queues, audit history, abuse signals, and policy decisions — rather than simply adding more general blog features.
Design the behaviour. Engineer for what happens next.