Kamal Joshi

Access & Refresh Tokens: Access tokens are stored in application memory (Zustand state) to defend against XSS, while refresh tokens are stored in secure, HTTP-only, and SameSite cookies.

Silent Rotation: Axios interceptors capture 401 Unauthorized responses automatically. Upon capture, the client triggers a refresh request to obtain a new access token and then transparently replays the failed request, preventing session interruption.

State & Cache: Migrated traditional state-based data fetching to RTK Query endpoints, reducing boilerplate and consolidating network state management.

Caching & Invalidation: Built automated query cache management with declarative tags (e.g., ['Books', 'Cart']), ensuring the UI updates automatically across pages after seller updates or checkouts.

Zero Latency: Mutates UI state instantly when users add or remove products from wishlists/carts before backend confirmation is received.

Smart Fallback: If the API request fails due to network issues, RTK Query's onQueryStarted catches the rejection and automatically rolls back the cache state to its pre-mutated value.

Federated Sign-In: Integrated Google OAuth 2.0 authorization code flow, generating secure accounts verified by Google.

Two-Factor Auth: Supports Time-based One-Time Passwords (TOTP) using standard authenticator apps (e.g., Google Authenticator). The backend handles QR-code generation and cryptographic secret storage.

Granular Access: Enforces dashboard, route, and endpoint authorization matching permissions (Customer, Seller, Admin) at the route level.

UI Adaptation: Conditionally renders dashboards, upload menus, and inventory metrics depending on the signed-in user's role, validated by token payloads.

Secure Checkout: Standardized payment flow by generating orders on the backend, launching the Razorpay modal, and verifying signatures.

Signature Verification: Uses SHA256 HMAC cryptographic signatures on the backend webhook to confirm success, protecting against payment spoofing attempts.

ACID Transactions: Utilizes MongoDB sessions during order checkouts to perform multi-document modifications (deducting stock, clearing cart, creating order) atomically.

Index Optimization: Implemented compound index profiles on active search terms, seller IDs, and category listings to optimize search execution speeds.

Latency Reduction: Caches dynamic product catalogs and filter configurations in memory using Redis to avoid expensive database query executions.

Cache Invalidation: Standardized write-through invalidation models, purging corresponding cache segments automatically on product edits or deletion.

Comprehensive Hardening: Configured Helmet to establish secure HTTP response headers, preventing clickjacking and MIME sniffing.

Rate Limiting & CSRF: Implemented IP-based request limits using express-rate-limit to thwart DDoS / brute-force attempts, alongside double-submit cookie validations for state-changing endpoints.

Infinite Scroll Stability: Built cursor-based pagination utilizing object identifiers to ensure stable results, avoiding skip-offsets during items insert/delete operations.

Debouncing: Captures keystrokes and runs search queries only after a 300ms pause, minimizing backend query execution volume.

Hydration & Paint Optimizations: Built custom CSS skeleton loaders to reduce layout shifts (CLS), improving perceived performance.

Rendering Strategies: Configured Next.js static generation (SSG) for static landing pages, server-side rendering (SSR) for real-time dashboards, and Incremental Static Regeneration (ISR) to refresh product details pages asynchronously.

Asset Ingestion: Processes multipart form-data via Multer, parsing files locally before uploading to Cloudinary.

Cloud Management: Formats, resizes, and compresses files dynamically inside Cloudinary transformation pipelines before delivery, improving response times.