CAPSULE
Production-Grade Visual Vlogging Platform with Security-First Architecture
Description
Full-stack vlogging platform implementing hardened stateless authentication with HttpOnly Secure cookie-based token delivery, JWT refresh token rotation with reuse detection, Redis cache-aside performance strategy, Bull-backed asynchronous processing, strict environment validation, and production-grade observability through structured logging, Prometheus metrics, Sentry error monitoring, and correlation ID tracing.
Problem Solved
Demonstrates a security-first and production-aware system architecture for a high-concurrency social content platform. The project tackles challenges such as stateless authentication security, safe token lifecycle management, asynchronous background processing, AI-powered moderation pipelines, scalable caching strategies, and real-time system observability.
Architecture
Layered Monorepo Architecture with Security Middleware, Async Workers, Observability, and AI Moderation. Client (React SPA) -> Express Middleware Stack -> Controller Layer -> Service Layer -> MongoDB + Redis Cache -> Bull Worker Processes -> External Services (Groq AI, Cloudinary, Email APIs).
Tech Stack
Tags
Scalability
Designed for horizontal scalability through stateless application servers, Redis-backed queues, cache-aside optimization, and asynchronous processing pipelines. The architecture supports scaling API nodes independently while Redis and MongoDB manage distributed state.
Architecture Breakdown
System Architecture
Architecture Schema
Distributed Node.js backend with AI moderation workers, async queues, and comprehensive observability.
Post-Forensic Engineering Improvements
Security Hardening
- ▹Removed accessToken and refreshToken from JSON API responses to eliminate XSS token exposure.
- ▹All authentication tokens are now delivered via HttpOnly and Secure cookies.
- ▹Refresh token lifecycle hardened using rotation and reuse detection.
- ▹Authentication flow redesigned to prevent client-side access to sensitive tokens.
- ▹Strict CORS allowlist implemented to block unauthorized cross-origin requests.
- ▹Helmet middleware integrated to enforce modern HTTP security headers.
- ▹MongoDB query sanitization added to prevent NoSQL injection.
Configuration & Secrets Management
- ▹Removed unsafe fallback secrets such as 'testsecret' from JWT configuration logic.
- ▹Implemented strict environment validation during application boot.
- ▹Application now terminates startup if critical environment variables are missing.
- ▹Critical variables validated include JWT_SECRET, REDIS_URL, FRONTEND_URL, and RESEND_API_KEY.
- ▹Removed hardcoded credentials from database seeding scripts.
- ▹Database seeding now requires explicit SEED_PASSWORD environment configuration.
Production Observability
- ▹Integrated Sentry v10 SDK for centralized error monitoring.
- ▹Prometheus metrics implemented using prom-client.
- ▹Queue telemetry exposed including queue_waiting, queue_active, queue_completed, and queue_failed.
- ▹Redis Bull queue monitoring dashboards implemented.
- ▹Correlation ID tracing added to track requests across services.
- ▹Structured logging implemented using Winston with log rotation.
Async Processing Reliability
- ▹Dead Letter Queue system implemented for permanently failed background jobs.
- ▹DLQ monitoring service isolates poisoned jobs automatically.
- ▹Queue spike detector alerts when failure rates exceed operational thresholds.
- ▹Exponential retry strategy implemented for failed worker tasks.
- ▹Background worker failures are isolated from primary API request lifecycle.
CI/CD Pipeline Stability
- ▹Resolved ESLint formatting violations that previously broke CI pipelines.
- ▹Strict lint enforcement enabled with npm run lint -- --max-warnings=0.
- ▹CI pipeline verified locally to match GitHub Actions workflow.
- ▹Repository now maintains zero lint violations.
Test Infrastructure Improvements
- ▹Security tests updated to support HttpOnly cookie authentication.
- ▹Token assertions migrated from JSON responses to Set-Cookie header parsing.
- ▹Implemented cookie extraction helpers for integration tests.
- ▹Injected safe environment variables during Jest bootstrap.
- ▹Achieved 162/162 passing unit and integration tests.
Engineering Outcome
- ▹Authentication flow hardened against token leakage vulnerabilities.
- ▹Application configuration now fails securely during invalid boot conditions.
- ▹Background worker reliability improved with DLQ isolation.
- ▹Production monitoring established using Sentry and Prometheus.
- ▹CI/CD pipeline stabilized through strict lint enforcement.
- ▹Full automated test suite passing across all security pathways.
Engineering Decisions
- ▹Stateless JWT authentication to enable horizontal scaling
- ▹HttpOnly cookie token delivery to eliminate XSS token exposure risk
- ▹Refresh token rotation with reuse detection to prevent token replay attacks
- ▹Cache-aside strategy to reduce database load on read-heavy endpoints
- ▹Bull queue architecture to offload expensive tasks from request lifecycle
- ▹Normalized engagement counters (likeCount, commentCount) for faster feed queries
- ▹Centralized error handling middleware for consistent API responses
- ▹Correlation ID tracing for distributed request debugging
- ▹Graceful degradation when Redis becomes unavailable
- ▹Express app/server separation to allow Jest imports without DB initialization
- ▹Async moderation pipeline to maintain low request latency
- ▹Strict environment validation preventing insecure boot configurations
Production Readiness
Media Proof
Project Videos
Project Screenshots
