BLOG.

Software engineering, AI systems and technical paper reviews.

Filtered byAPI DesignClear

Backend24 July 2026 · 6 min read

My ASP.NET Core App Called Its Own API Over HTTP→︎

MobiShare's Razor Pages, SignalR hub, and MQTT handler all call the app's own Web API over loopback HTTP instead of in-process — forcing a cookie-forwarding handler and an AsyncLocal hack. An accidental distributed monolith, and what it cost.

Backend22 July 2026 · 6 min read

The API Had No Lock: Finding an ASP.NET Core Auth Hole in My Own App→︎

app.UseAuthentication() was never called and no API controller had [Authorize]. The whole JSON API was open to anyone. Here's how I found it, and what it actually took to fix it without breaking the app.

Backend14 July 2026 · 6 min read

CQRS with MediatR in a Real ASP.NET Core App: Worth It?→︎

Mobishare splits every operation into a MediatR command or query, one file each, thin controllers throughout. Here's what that buys you — and the swallowed-exception bug it let slip through.

That's the feed.

I write about the backend×AI wedge — wins and failures included. Follow along, or say hi.

Follow on GitHub↗︎