Devy

Devy Archive

Notes on backend engineering, platform operations, and the decisions behind them.

29 posts · 7 series · 67 tags

Recent Posts

2026-04-240

JWT Signing Migration - From HS256 to RS256/JWKS/KMS

How I split signing responsibility, kid, key rotation, and legacy token handling while moving symmetric JWT signing to RS256, JWKS, and KMS.

authenticationjwtjwkskmsjavaspringsecurity

2026-04-170

Splitting Login Responsibility (3) - Verifying Old Tokens and New Backend Tokens Together

How I split verification order and failure handling when old frontend tokens and new backend-issued tokens had to be accepted through the same browser cookies.

authenticationoauthjwttestingmigrationjavaspring

2026-04-160

Splitting Login Responsibility (2) - Connecting the authorize/callback Flow

How the frontend connects the login flow from protected page access to backend authorize, callback, and token issuance.

authenticationoauthfrontendbackendtypescriptjavaspring

2026-04-150

Splitting Login Responsibility (1) - Why I Moved It from Frontend to Backend

The responsibility boundaries I used while moving login state from a frontend-owned flow to a backend-owned authentication flow.

authenticationoauthbackendfrontendarchitecture

2026-03-240

Platform Thread vs Virtual Thread vs Coroutine - 10,000 Task Benchmark

A benchmark comparing JDK 25 Platform Threads, Virtual Threads, and Kotlin Coroutines across I/O-bound, CPU-bound, and high-concurrency scenarios with 10,000 tasks repeated 100 times.

javakotlinvirtual-threadscoroutinebenchmarkconcurrency