BLOG.

Software engineering, AI systems and technical paper reviews.

Filtered bySignalRClear

Backend24 July 2026 · 6 min read

My ASP.NET Core App Called Its Own API Over HTTP→︎

MobiShare's Razor Pages, SignalR hub, and MQTT handler all call the app's own Web API over loopback HTTP instead of in-process — forcing a cookie-forwarding handler and an AsyncLocal hack. An accidental distributed monolith, and what it cost.

Backend22 July 2026 · 6 min read

The API Had No Lock: Finding an ASP.NET Core Auth Hole in My Own App→︎

app.UseAuthentication() was never called and no API controller had [Authorize]. The whole JSON API was open to anyone. Here's how I found it, and what it actually took to fix it without breaking the app.

Backend18 July 2026 · 5 min read

Reservation State Can't Live in a UI Countdown→︎

Mobishare's vehicle-reservation timer was a singleton service holding one connection ID for the entire app, with expiry driven by client-side JavaScript. Here's why that's a concurrency bug, not a UI detail.

AI x Backend16 July 2026 · 6 min read

A Local LLM Chatbot with Tool-Calling and RAG (No Vector Database)→︎

How I wired Ollama into a real ASP.NET Core app with native tool-calling and a hand-rolled cosine-similarity RAG — no vector DB, no cloud API — and the concurrency bug that nearly broke it.

That's the feed.

I write about the backend×AI wedge — wins and failures included. Follow along, or say hi.

Follow on GitHub↗︎