The Matlab Blog

Insights on building great software

Engineering, design, DevOps, and product playbooks from the team behind 600+ shipped projects. New articles published regularly.

Authentication answers who the user is and authorization answers what the user can do

Security

October 31, 20266 min read

Authentication vs Authorization: Sessions, JWTs, Refresh Token Rotation, and When JWT Is the Wrong Tool

Learn how authentication differs from authorization, how sessions and JWTs work, why refresh tokens rotate, and when a session beats a JWT.

An API adds a job and responds, a Redis queue holds it, and a worker retries it and records the failure

Architecture

October 31, 20269 min read

Background Jobs in Node.js: Designing Reliable Async Processing

Learn how to design reliable Node.js background jobs with queues, workers, retries, idempotency, concurrency, timeouts, and failure handling.

Unredacted and redacted log lines side by side, with the SSN replaced by [REDACTED]

Security

October 31, 202615 min read

Handling PII/PHI: Redaction, Logging, Error Reporting, and Data Retention

PII/PHI handling for healthcare apps: log redaction, PHI-safe error reporting, field-level encryption, and automated data retention, with production code.

Three stacked cards naming what Playwright MCP gives an assistant: navigating pages, filling forms and clicking, and reading page structure as roles and names

Engineering

October 31, 202610 min read

Playwright MCP for AI-Powered UI Testing

Use Playwright MCP to drive a real browser with an AI assistant, check real user journeys, and turn the ones worth keeping into Playwright tests.

A fast producer and a slower consumer kept in balance by a bounded queue that waits or rejects work when it is full

Architecture

October 31, 20268 min read

Backpressure: What Happens When Producers Are Faster Than Consumers?

Learn how backpressure stops growing queues with bounded buffers, rate limits, concurrency limits and retries, so producers never overload consumers.

A renamed API field that still returns 201, caught by a contract test before deploy

Engineering

October 31, 20269 min read

Contract Testing Between Frontend and Backend Teams

Learn how consumer-driven contract testing with Pact catches breaking API changes between React frontends and Node.js backends before they reach production.

Designing reliable webhook processing systems overview

Architecture

October 31, 202626 min read

Designing Reliable Webhook Processing Systems

Learn how to build resilient webhook consumers: fast acknowledgment, database idempotency, partition queues, capped retries, and data reconciliation.

Rolling, blue-green and canary deployments compared by how many users a bad release can reach

DevOps

October 31, 20266 min read

Blue-Green vs Canary vs Rolling Deployments: Choosing Based on Blast Radius

Compare blue-green, canary and rolling deployments by blast radius: how many users a bad release reaches, how fast you can stop it, and what each costs.

API idempotency flow showing safe retries and duplicate request prevention

Architecture

October 31, 20269 min read

Idempotency by Design: Making APIs Safe to Retry

Learn how API idempotency prevents duplicate operations on retries, with idempotency key patterns, database design, race-condition handling, and Node.js code.

A request passes through a single authorization decision point before it is allowed or denied

Security

October 31, 202622 min read

Authorization Design: RBAC, ABAC, and Permission Models That Scale

A practical guide to authorization design: tenant-scoped RBAC, ABAC conditions, ReBAC sharing, and Postgres row-level security, with real code.

An app calling any provider through a single adapter boundary

Architecture

October 31, 20269 min read

Universal Third-Party Integration Framework: Adapters, OAuth, Webhooks, Retries, Rate Limits, and Sync

Build one integration layer for every provider: adapters, OAuth refresh, signed webhooks, retries with jitter, rate limits and cursor-based sync.

Services connected by events across three availability zones

Architecture

October 31, 20268 min read

What Are Microservices, Event-Driven Architecture, and Multi-Zone Deployment?

Learn what microservices, event-driven architecture, and multi-zone deployment are, how they work together, and which trade-offs to weigh before you adopt them.

Choosing between fixing a slow query and adding a cache in front of it

Architecture

October 31, 20267 min read

Application Caching: Should You Add a Cache When Your App Is Slow?

Application caching only helps when work repeats. Learn when to add a cache, how browser, CDN, app and database caches differ, and what they cost.

REST API design cover showing resource URLs, one error format, and a versioned contract

Architecture

October 31, 20269 min read

REST API Design: Building Maintainable APIs as Products Grow

Learn REST API design best practices for maintainable APIs, including resource structure, validation, errors, versioning, security, testing, and performance.

Trace waterfall of a 5.48-second checkout request with the critical path highlighted, showing how distributed request latency is spread across overlapping spans

DevOps

October 31, 202614 min read

Debugging Distributed Request Latency: Finding Where Time Is Actually Spent

Learn to debug distributed request latency using distributed tracing — critical paths, self-time, tail latency, and sampling, with real production data.

Optimistic concurrency checks a version at save time while pessimistic locking locks the row first

Databases

October 31, 20268 min read

Optimistic Concurrency vs Pessimistic Locking: Choosing the Right Strategy

Learn how optimistic concurrency and pessimistic locking prevent lost updates, with SQL and Node.js examples, common pitfalls, and when to use each.

Three app servers reach one shared lock so the job runs once

Architecture

October 31, 20267 min read

Distributed Locks in Real Applications: Preventing Duplicate Jobs, Token Refreshes, and Concurrent Updates

How distributed locks stop duplicate jobs, token refresh stampedes and lost updates in Redis and Postgres, and why a lock alone is never a guarantee.

A producer adding a job to a queue, a worker processing it, and the job completing or retrying into a dead letter queue

Architecture

October 31, 202612 min read

Queue-Based Architecture in Practice: BullMQ, RabbitMQ, SQS, Workers, Retries, DLQs, and Job Deduplication

A plain-language, code-tested guide to queue-based architecture: workers, retries, dead letter queues, and job deduplication in BullMQ, RabbitMQ, and SQS.

A client request to an API times out and is retried until it gets a successful response

Architecture

October 31, 20267 min read

Resilient API Design: Retries and Timeouts

Build resilient APIs with timeouts, safe retries, backoff, jitter and idempotency keys to prevent duplicate orders during network failures.

Push notifications end to end in React Native: tokens, FCM and deep links

Mobile

October 28, 20269 min read

Push Notifications End to End in React Native: Tokens, FCM and Deep Links

Build push notifications end to end in React Native: permissions, FCM tokens, a Node.js backend, deep links, token refresh and troubleshooting.

A primitive token holding a raw blue, a semantic token pointing at it, and a component reading only the semantic token

Frontend

October 26, 202610 min read

Design Tokens and Theming: One Source of Truth for Color, Spacing, and Dark Mode

Learn how design tokens, CSS variables, semantic tokens, and theming create a consistent UI and simplify light and dark mode.

Default isolation lets lost updates and write skew through, while atomic updates and locks keep the rule intact

Databases

October 26, 20269 min read

Transaction Isolation Levels and the Subtle Bugs They Hide

Learn how transaction isolation levels work in PostgreSQL and MongoDB, why lost updates and write skew slip through, and how to fix them.

Architecture

October 26, 202610 min read

Real-Time Architectures: Polling vs SSE vs WebSocket vs Push — How to Choose

Learn when to use Polling, SSE, WebSocket or Push Notifications in a real-time architecture, based on who sends data, latency and whether the app is open.

Docker image size cover comparing a 1.67 GB naive Node.js image with a 217 MB multi-stage distroless image

DevOps

October 24, 202610 min read

Optimizing Docker Image Size: Multi-Stage Builds, Layer Order, and Distroless Images

Shrink a Node.js Docker image from 1.67 GB to 217 MB with multi-stage builds, cache-friendly layer order, .dockerignore and distroless images.

Cover for Server Components vs Client Components: 'use client' marks a door between the server and client module graphs, with code crossing through imports and data through props

Frontend

September 4, 202618 min read

Server Components vs Client Components: The Mental Model That Actually Sticks

How the RSC boundary works: two module graphs, what crosses through imports and props, and the errors that name the rule you broke.

Insights on building great software

Let's Collaborate