Notes & essays
Writing
Working notes on software engineering, product security, automation, and whatever becomes useful to explain.
- Designing a Hotel Booking Service Like Expedia
Designing a hotel search and booking aggregator that connects travelers to prices and inventory from thousands of hotel suppliers.
- Authorization in Practice: Who Can Do What to Which Resource?
A practical application-security guide to RBAC, ABAC, ReBAC, enforcement points, Java authorization checks, multi-tenant boundaries, testing, and failure behavior.
- IAM for Application Security: Identities Have a Lifecycle
A practical guide to the identity lifecycle inside a modern application: SSO, SCIM, local accounts, workload identities, revocation, and privileged access.
- What 1,000 Services Actually Teach You About System Design
Lessons from Matt Ranney's Uber talk on why microservices scale organizations, how tail latency compounds, and why observability, failure testing, and migration must be designed in.
- CSRF: When the Browser Sends the Wrong Request
A practical explanation of Cross-Site Request Forgery, how CSRF tokens stop it, and how to protect Spring applications with layered browser controls.
- SQL Injection: When Data Changes the Query
A practical Java guide to SQL injection, parameterized queries, dynamic sorting, ORM pitfalls, least privilege, and interview-ready review habits.
- SSRF: When Your Server Becomes the Attacker's HTTP Client
A practical guide to Server-Side Request Forgery in URL imports, webhooks, and previews, with layered Java, network, redirect, and cloud defenses.
- XSS: When Untrusted Data Becomes Browser Code
A developer-focused guide to stored, reflected, and DOM XSS, with practical Thymeleaf, JavaScript, sanitization, CSP, and cookie defenses.
- Identity and Access Security Interview Question Bank
A curated set of high-frequency interview questions about authentication, IAM, authorization, sessions, tokens, federation, PKI, identity lifecycle, and application-security trade-offs.
- MFA Is More Than a Second Prompt
A practical guide to choosing MFA, understanding phishing resistance, and securing enrollment, recovery, step-up authentication, and the session that follows.
- From Public Keys to PKI: How Certificates Create Trust
A practical path from private and public keys through PEM, certificates, proof of possession, trust chains, public and private CAs, mTLS, and certificate lifecycle.
- How Modern Web Authentication Fits Together
A start-to-finish guide to passwords, passkeys, sessions, JWTs, OAuth, OIDC, SSO, browser and mobile token storage, and the trust boundaries connecting them.
- Designing a Secure Multitenant Workforce Platform
A practical system design case study for shared HR, time-off, payroll, and document services, covering tenant isolation, authorization, Kubernetes, audit logs, and emergency access.
- How does TLS turn a trusted certificate into encrypted HTTP?
Watching a real TLS 1.3 handshake to see how authentication, ephemeral key agreement, and symmetric encryption create a secure HTTPS connection.
- How does Chrome know the server is really yifanzhai.com?
Inspecting a real certificate, following its trust chain, and breaking one validation check at a time to see why Chrome trusts—or rejects—an HTTPS server.
- What happens when you enter a URL in your browser?
Tracing yifanzhai.com through DNS—from my laptop through the root and .com nameservers to Cloudflare—and asking what happens if DNS lies.