Evomedia.netBlog
Technical deep-dives from the trenches.
AWS, Docker, nginx, full-stack deployments, and lessons learned building and running production systems.
-
AWS EC2 Recovery: Two-Layer Backup with AMI and Configuration Export
When an EC2 instance disappears, you need both the disk (data) and the wiring (network, security, IAM). Create an EBS AMI for restorable backups and export JSON configuration files for deployment recovery.
-
AWS 502 Bad Gateway: Stop CloudFront from Caching Your Deploy Outages
Every deploy was triggering a CloudFront-cached 502 that forced a manual invalidation. Here's the three-part fix — nginx DNS TTL, CloudFront error caching, and the cache policy that finally made deploys silent.
-
Stored XSS in Admin Dashboards: The innerHTML Trap and How to Escape It
User-controlled data from logs and APIs ends up in innerHTML, turning your admin dashboard into an attack surface. How this vulnerability happens, why escaping matters, and the DOM API fix.
-
SMTP Header Injection via Form Fields: Why .trim() Isn't Enough
A contact form that sanitizes HTML but forgets newlines becomes an SMTP header injection vector. How attackers inject Bcc:, Cc:, and Subject: headers, and the one-line fix.
-
Security Headers You Forgot: CSP, X-Frame-Options, and nginx
Most sites skip the headers that actually stop browsers from being tricked. A practical guide to CSP, X-Frame-Options, X-Content-Type-Options, and why nginx is the right place to enforce them.
-
CloudFront Cache Busting Beyond Invalidation: Immutable Assets and Smart Versioning
Manual invalidations are a sign you're fighting your CDN. Vite's content hashing, immutable headers, and origin cache-control policies eliminate the need for cache busting entirely.