This series of posts and associated code is aimed at removing the mystery of SAML implementation and highlight what is happening in the common SAML workflows.

What is SAML?

• Security Assertion Markup Language (better known as its acronym, SAML) is a protocol for authenticating to web applications.

But why do we need such a protocol?

• Imagine you build a web application which you would want to sell to Enterprises.
• Now, as the users (say employee of this company) access your application, you would like them to authenticate against the company login system.

🔥 Of course the other choice is that users register with your application and then your app maintains their…

Google Protobuf development guide notes the following —

Protocol Buffers are not designed to handle large messages. As a general rule of thumb, if you are dealing in messages larger than a megabyte each, it may be time to consider an alternate strategy.

This blog walks through implementation of one such strategy. Basic familiarity with Go and Protobuf is assumed

The Message

Lets define a simple message, Book as following —

message Book {    string title = 1;    string author = 2;    string isbn = 3;    string overview =4;
}

Goal : We would like to marshal arbitrarily large number of Book…

This tutorial provides a basic Go introduction to working with protocol buffer Oneof field type. This can come in handy, when dealing with messages carrying values, which can be one of many given types. Another use case is message values representing a collection of heterogenous types.

Pre-requisite : This post assumes reader has basic understanding of Go and Protobuf.

Defining the Message

• Lets define a message that contains a collection of patching instructions
• Each patching instruction can either be a Copy operation or an Insert operation. These are heterogenous types

This is a good use of Oneof type. …

Why do we need Rate Limiting?

Picture this : You have a service with a great REST API, and its being used by many clients. These could be services within your own organization or some third party applications.

It’s all going good but one day lightening strikes.

Users are complaining of high latency and your service being unavailable intermittently. You investigate and find out that one of your clients was hitting your API 10X times than its normal request rate, that led to 100% CPU utilisation on your DB and other resources. When that client cools off, things become normal. …

There is tonne of information available on Go Concurrency and context usage like the context package, this blog and this but it can be a bit overwhelming. This article attempts to explain Context via a simple but perhaps the most common use case you would find in Microservices architecture.

Pre-Requisite

Article assumes that Reader is familiar with Goroutines, channels and HTTP

Why Context?

The primary idea behind context is the ability to cancel unneeded work.

• A calls B
• B starts to do work
• While B is working, A no longer needs the result either because B is slow, or A’s caller no longer…

Part II of the tutorial dealt with complex CORS requests and pre-flight check by the browsers. In this final part, we look at dealing with cookies in CORS . We will also look at subtle differences between same site and same origin and how it impacts cookie behaviour.

Cookies

By default, Cookies are neither set nor sent in CORS Requests. Let’s see that in a bit more detail.

The Cookie Demo Page

• Its a simple HTML page served by the PageServer, which allows you to play with different scenarios
• What we are going to do is first make a request to APIServer for user “john”…

Continuing from Part-I where we successfully handled a cross-origin “simple” request, lets see what non-simple requests are and what we can do to enable support for such requests.

Example #2 — Complex Requests

Starting from where we left off. We were running a PageServer serving HTML pages and an APIServer serving GetUser API call to return User JSON.

Lets see what happens when we now try to create a user using Javascript

• Point your browser to createUser.html . You should see something like this

Richer and interactive web pages today are built using dynamic client side scripting. It’s extremely common to have the javascript in the page interact with different web APIs transparently, to provide a smooth experience to the user. But when the script in your page needs to interact with APIs that belong to a “different” origins then it comes in conflict with browser’s same origin policy.

This article aims to provide a complete hands-on tutorial to help you understand CORS in detail, as well as what is needed to support Cross Origin request by Servers

Pre-Requisites

To try live demos as you…