A Blog full of Web Projects
Webpack 5 boilerplate with React and TypeScript
28-July-2026
A Webpack 5 boilerplate with React and TypeScript
Try the demo...The code at GitHub
A Webpack 5 boilerplate with React and TypeScript. Babel 7 compiles the TypeScript files to ES5. The Webpack module "fork-ts-checker-webpack-plugin" handles the type checking. The demo App serve React routing, a Webpack logo, my photo with some info and compiled PostCSS. Bootstrap CSS was used to make the demo mobile friendly.
Webpack 5 boilerplate with ES6 and above
26-July-2026
Webpack 5 boilerplate ready for ES6 and above
Try the demo...The code at GitHub
A Webpack 5 boilerplate ready for ES6 and above using Babel. The demo App serve a Webpack logo, compiled PostCSS and consumes a web api from jsonplaceholder showing examples of async operations using async / await.
Webpack 5 boilerplate with React
26-July-2026
A Webpack 5 boilerplate with React
Try the demo...The code at GitHub
A Webpack 5 boilerplate with React. The demo App serve React routing, a Webpack logo, my photo with some info and compiled PostCSS. Bootstrap CSS was used to make the demo mobile friendly.
Python FastAPI and Vue Authentication Boilerplate Recommendations and Use Cases
15-July-2026
Python FastAPI and Vue Authentication Boilerplate Recommendations and Use Cases
Over time, I have built several FastAPI + Vue authentication projects, each introducing a different authentication strategy. The right choice depends on the security requirements, application type, and desired user experience.
1. HTTP Basic Authentication
Recommended for:
Internal tools, small APIs, admin dashboards, and simple authenticated services.
This is the simplest authentication approach in the series. It is easy to understand and implement, making it suitable for smaller applications where users authenticate directly with a username and password.
Good use cases:
- Internal company tools
- Developer or admin dashboards
- Simple CRUD applications
- Learning FastAPI authentication dependencies
Not recommended for:
- Large public-facing applications
- Modern SPA applications requiring persistent sessions
- Systems requiring advanced token security
2. JWT Authentication (Access Tokens)
Recommended for:
APIs and applications requiring stateless authentication.
This boilerplate introduces JWT-based authentication where users receive an access token after login. The token is then used to access protected API endpoints.
Good use cases:
- REST APIs
- Mobile applications
- Single Page Applications (SPA)
- Microservice architectures
- Systems where server-side sessions are not desired
Advantages:
- Stateless authentication
- Easy API integration
- Scales well across multiple services
Limitations:
- Users need to log in again when tokens expire
- Token revocation is more difficult
3. JWT Refresh Token Renewal
Recommended for:
Single Page Applications and applications requiring longer user sessions.
This version introduces refresh tokens, allowing users to stay logged in after the short-lived access token expires.
Good use cases:
- Vue, React, and Angular applications
- User dashboards
- SaaS applications
- Applications where user experience is important
Advantages:
- Better user experience
- Short-lived access tokens improve security
- Users do not need frequent logins
Limitations:
- Refresh tokens must be protected carefully
- Basic refresh token handling does not detect token theft
4. JWT Refresh Token Rotation
Recommended for:
Production applications requiring stronger session security.
Refresh token rotation improves security by replacing the refresh token every time it is used. Each refresh operation creates a new token pair.
Good use cases:
- SaaS platforms
- Customer-facing applications
- Applications handling sensitive user data
- Long-lived user sessions
Advantages:
- Reduces the lifetime of stolen refresh tokens
- Makes token replay more difficult
- Follows modern authentication practices
Limitations:
- Requires more backend logic
- Token management becomes more complex
5. Refresh Token Reuse Detection (Without HTTP-only Cookies)
Recommended for:
Advanced authentication systems where refresh token attacks need to be detected.
This version adds detection of revoked refresh token reuse. If an old refresh token is used after rotation, the system can identify suspicious activity.
Good use cases:
- Security-focused applications
- Learning advanced authentication concepts
- Systems requiring visibility into suspicious sessions
Advantages:
- Detects refresh token replay attempts
- Improves security monitoring
- Adds protection against stolen refresh tokens
Limitations:
- Refresh tokens are still exposed to JavaScript if stored client-side
- Requires careful client-side handling
6. Refresh Token Reuse Detection with HTTP-only Cookies
Recommended for:
Production-grade web applications with high security requirements.
This is the most advanced version in the series. It combines refresh token rotation, reuse detection, and HTTP-only cookies to reduce exposure of sensitive tokens in the browser.
Good use cases:
- Production SaaS applications
- Banking and finance systems
- Enterprise applications
- Applications handling sensitive user information
Advantages:
- Refresh tokens are protected from JavaScript access
- Detects refresh token replay attempts
- Provides stronger protection against XSS-related token theft
- Better aligned with modern browser security practices
Considerations:
- Requires CSRF protection strategies
- More complex cookie and session management
Suggested Default Choice
- Learning project: HTTP Basic Authentication or JWT Authentication
- Small production API: JWT with Refresh Token Renewal
- Modern SaaS application: Refresh Token Rotation
- Security-focused production system: Refresh Token Rotation with Reuse Detection and HTTP-only Cookies
The final HTTP-only cookie version is the strongest foundation for most new web applications, while the earlier versions remain valuable as lightweight templates depending on project requirements...
Happy coding :-)
Python and Django Starter Website using PostgreSQL hosted at Vercel Cloud serving a Blog
08-July-2026
Python Django and PostgreSQL Starter Website serving a simple Blog hosted at Vercel Cloud using Serverless Functions implementing DevOps by GitHub + Vercel
Try the demo...Django is using the architectural pattern Model-View-Template (MVT) which is a derivation of the pattern Model View Control (MVC)
This Django Website is serving static content - secured by HTTPS
A simple Blog demonstrates how to use Models by the Django Admin and display the Posts by the Frontend
The files models.py and views.py are splitted up for showing how to scale the folder structure if the Django Website should grow with a lot of views and models
CI / CD by VS Code + GitHub + Vercel Cloud
The source code at GitHub