The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
SSE over nginx + PHP-FPM: the buffering problem nobody warns you about
Server-Sent Events look dead simple until nginx and PHP-FPM start swallowing your stream. Here's what actually happens and how to fix it.
Every SSE tutorial on the internet shows you the same 15 lines of PHP and calls it done. What they don't show you is the part where you deploy to a real nginx + PHP-FPM stack and your beautifully streaming events arrive in one giant blob — or not at all — because three different layers are buffering your output…
Read the daily →Laravel Sanctum SPA Auth Across Subdomains Will Bite You
Sanctum's subdomain cookie auth looks simple until CORS and session config conspire to ruin your day. Here's the config that actually works.
Sanctum's documentation makes subdomain SPA authentication look like a ten-minute job. It is not a ten-minute job. I've set this up across probably a dozen projects now — e-commerce frontends on hitting APIs on , healthcare portals, a real estate dashboard — and every single time there's a moment where the cookie just…
Read the daily →The nginx directive that cuts PHP-FPM overhead in half
One keepalive line in your nginx upstream block and you stop paying TCP handshake tax on every PHP request. Here's why it's off by default and how to tune it.
I've tuned a lot of nginx configs over the years and I kept seeing the same thing: servers handling two or three hundred PHP requests per second with perfectly healthy CPU and memory numbers, but p99 latency sitting higher than it should be. The culprit, more often than not, was sitting right in the upstream block…
Read the daily →Pipedream vs. a webhook relay you own: when trust gets expensive
Pipedream is genuinely good until your payload contains PHI or a signing secret. Here's where I draw the line.
Pipedream is one of those tools I recommend without hesitation — right up until I can't. The line isn't arbitrary. It's the moment a payload contains something I'm not allowed to hand to a third party, or the moment the business logic is complex enough that I'm fighting the platform instead of using it. Let me walk…
Read the daily →MariaDB JSON vs Postgres JSONB: What You Actually Lose
I've run both in production. MariaDB's JSON support is not what Postgres JSONB is, and the gap matters more than MariaDB's docs let on.
I keep running into developers who assume MariaDB's JSON column support is roughly equivalent to Postgres JSONB. It is not. The marketing language is similar, the SQL syntax looks similar, but under the hood they're solving the problem at completely different levels of seriousness. After running both in production…
Read the daily →