https://korrali.com/blog/ Engineering write-ups from Ashish Bhagat: building the identity and SSO platform for Oman's National Port Community System, solo, backend to frontend. en-us Thu, 13 Aug 2026 00:00:00 GMT https://korrali.com/blog/ava-not-a-sequence/ https://korrali.com/blog/ava-not-a-sequence/ Thu, 13 Aug 2026 00:00:00 GMT Java 17's stricter X.509 parser rejected a government IdP's SAML certificate with 'AVA not a sequence.' The fix: parse it with BouncyCastle instead. https://korrali.com/blog/hot-reload-saml-signing-certificate/ https://korrali.com/blog/hot-reload-saml-signing-certificate/ Thu, 13 Aug 2026 00:00:00 GMT A cached SAML signing certificate breaks the moment an IdP rotates it. How I made ours hot-reloadable with automatic on-failure refresh instead of an outage. https://korrali.com/blog/bank-muscat-error-10001/ https://korrali.com/blog/bank-muscat-error-10001/ Thu, 13 Aug 2026 00:00:00 GMT A browser GET to Bank Muscat's payment endpoint silently dropped the encrypted POST body. The fix: a backend-rendered auto-submit form instead of a redirect. https://korrali.com/blog/three-clocks-racing/ https://korrali.com/blog/three-clocks-racing/ Thu, 13 Aug 2026 00:00:00 GMT A 10-minute invoice expiry, 2-minute polling, and 60-second reconciliation could all disagree. Two finalization paths and an idempotency guard fixed it. https://korrali.com/blog/it-was-never-the-network/ https://korrali.com/blog/it-was-never-the-network/ Thu, 13 Aug 2026 00:00:00 GMT Intermittent 500s and 503s during UAT looked like India–Oman latency. A 60-second timeout against 100–250ms real RTT proved it couldn't be. https://korrali.com/blog/fixing-idor-properly/ https://korrali.com/blog/fixing-idor-properly/ Thu, 13 Aug 2026 00:00:00 GMT A pentest found five IDOR-class findings — any user could delete or lock any other. The fix: object-level authorization plus a build-failing regression suite. https://korrali.com/blog/spring-data-jpa-null-version-trap/ https://korrali.com/blog/spring-data-jpa-null-version-trap/ Thu, 13 Aug 2026 00:00:00 GMT @Version plus save() on a fresh entity throws duplicate-key errors, not optimistic-lock exceptions. Why, and the find-then-update pattern that fixes it. https://korrali.com/blog/sso-handshake-no-standard/ https://korrali.com/blog/sso-handshake-no-standard/ Thu, 13 Aug 2026 00:00:00 GMT No RFC covers silently launching a downstream app after your own SSO event. Designing a one-time-token handshake from scratch, and what broke on first contact. https://korrali.com/blog/hand-rolled-soap-clients/ https://korrali.com/blog/hand-rolled-soap-clients/ Thu, 13 Aug 2026 00:00:00 GMT Two government SOAP APIs, neither with a WSDL you could actually generate stubs from. Building the client by hand with DOM and XPath instead. https://korrali.com/blog/hexagonal-architecture-verify-by-grep/ https://korrali.com/blog/hexagonal-architecture-verify-by-grep/ Thu, 13 Aug 2026 00:00:00 GMT Anyone can claim hexagonal architecture. The real test: grep the domain package for framework imports. Here's what that discipline actually buys you. https://korrali.com/blog/angular-18-to-21-security-upgrade/ https://korrali.com/blog/angular-18-to-21-security-upgrade/ Thu, 13 Aug 2026 00:00:00 GMT A mid-project Angular 18 to 21 upgrade, done to close an npm audit backlog before a VAPT cycle: 48 vulnerabilities, 28 high, down to 2 moderate. https://korrali.com/blog/mock-and-real-adapters-behind-ports/ https://korrali.com/blog/mock-and-real-adapters-behind-ports/ Thu, 13 Aug 2026 00:00:00 GMT Every external dependency in CLP had a mock and a real adapter behind the same port, toggled by Spring profile. What that bought, and what it couldn't.