·5 min read
Framework guides: Next.js, Vite, edge runtimes, and plain Node
The same client, wired up correctly in four different environments — and the one Next.js mistake that quietly defeats the RPC bridge from the last two posts.
❯grep -rl "#nextjs" ./posts
#nextjs
15 posts
·6 min read
The SSR RPC bridge, part 2: the security model, threat by threat
Deny-by-default is one layer. Here's every other threat the bridge is built to handle — prototype pollution, CSRF, and the line between what it secures and what your code still has to.
·5 min read
The SSR RPC bridge, part 1: your backend URL is in the browser bundle right now
Import your normal API client into a client component and check the Network tab. This is the architecture that stops that from happening.
·10 min read
One BigInt in your log data deletes every other field
One BigInt makes JSON.stringify throw, so your logger drops every other field too. What I measured, and a safe() helper that keeps Dates and Errors intact.
·7 min read
Why your serverless function loses its last logs
Batched logs sit in memory until a timer fires. Serverless freezes your function the moment it responds. Here is what I measured, and the one-line fix.
·9 min read
What really happens when two requests share one console.time() label
Everyone says console.time() breaks under concurrency because the second call overwrites the first. I tested it in Node, Bun and Deno, and that is not what happens. The second timer is thrown away, the fast request reports the slow request's duration, and the slow request reports nothing at all.
·8 min read
My debug log rule did nothing, and the reason was the order of the commas
I set LOG_LEVEL to turn on debug logs for one feature. Nothing appeared. The rules were spelled correctly — they were just in the wrong order. Here is what I measured, and the rule that tells you which order is right.
·4 min read
One client, many tenants: doing multi-tenancy without a footgun
How to resolve the right tenant ID per request in a shared SSR client — and why ambient context beats passing tenantId through every function call.
·11 min read
How to catch every uncaught error in a Next.js app, including the ones window.onerror silently misses
window.onerror is the answer everyone gives. It never fires for a broken image, and the next library that loads can delete yours. Here is what to use instead, on the client and on the server, tested in a real browser.
·9 min read
How to turn minified chunk paths in your error logs back into real filenames
A crash at chunks/page.js:1:518 tells you nothing. Source maps turn it back into checkout.ts:3:49. Here's how the lookup works, and the one case where it hands you a real-looking line number that is completely wrong.
·18 min read
How to tag every log line with a request ID using AsyncLocalStorage (and the 3 places it silently gives you nothing)
AsyncLocalStorage lets you stamp a request ID onto every log line without passing it through every function. But it can fail without throwing a single error — so your logs just quietly lose the ID. Here are the three cases I reproduced, and the two-minute check that catches them.
·11 min read
How to stop a re-rendering React component from flooding your logging endpoint
A component that logs on every render can fire dozens of network requests per second. Here's how per-level throttle, debounce and rate-limit policies fix it — including the one-word config typo that silently brings the flood right back.
·8 min read
How to log from the browser straight into your terminal in Next.js (without opening a public endpoint)
The problem with console.log in the browser, why a naive 'POST logs to the server' endpoint is a security hole, and how @developerehsan/nextjs-logger solves both with one import.
·11 min read
The three concepts you need before you write a single line of api-client
Before touching config options, understand the client, the modules, and the pipeline — the three ideas everything else in api-client is built on.
·6 min read
I kept rebuilding the same fetch wrapper. So I built api-client instead
Every project I ship ends up with the same auth-retry-cache logic copy-pasted and slightly broken. Here's why I finally turned that pattern into a real package.