When you log in to a website, a lot happens behind the scenes to keep your account safe. I built the backend for Web3 Broadcast, a platform for Web3 news, jobs, airdrops, events, and research, and security was one of the parts I spent the most time on.
This post explains how it works using something everyone understands: attending a big event.
Logging in: getting your wristband
When you arrive at an event, you show your ID once at the entrance and get a wristband. After that, security guards don't ask for your ID again. They just glance at the wristband.
Logging in works the same way. You enter your email and password once. If they're correct, the server gives your browser a digital wristband called an access token. Every time you do something afterwards, like posting an article or applying for a job, your browser shows that token instead of your password.
The token is signed with a secret only the server knows, so nobody can make a fake one. It's like a wristband with a special hologram that can't be copied.
Why the wristband expires after 15 minutes
Here's a question: if someone steals your wristband, how long can they use it?
That's why Web3 Broadcast's access tokens only last 15 minutes. A short life means a stolen token isn't useful for long.
But nobody wants to type their password every 15 minutes. So alongside the wristband, you also get a second item: a refresh token, which lasts 30 days. Think of it as a claim ticket stored safely in your pocket. When your wristband expires, you quietly hand in the claim ticket and get a fresh wristband, without having to show your ID again.
Two extra safety details:
- Every claim ticket works only once. When you trade it in, you get a brand new wristband and a brand new claim ticket, and the old ticket is destroyed. This is called token rotation. If a thief copies your ticket and you both try to use it, only one works.
- The server never keeps the actual ticket. It only stores a scrambled fingerprint of it (a hash). Even if someone broke into the database, they couldn't read the tickets.
Logging out: cutting off the wristband
Here's a tricky problem. The wristband is designed so guards can check it on their own, without phoning the front desk. That's what makes it fast. But it also means that when you log out, your wristband technically still looks valid until it expires.
So what stops someone from using it in those remaining minutes?
The answer is a blocklist. When you log out, the server writes your wristband's unique ID onto a list of cancelled wristbands, kept in Redis, a very fast in-memory database. Every guard checks that list before letting anyone through. A cancelled wristband gets turned away, even if it hasn't expired yet.
The blocklist cleans itself up, too. Each entry is set to disappear after 15 minutes, because by then the wristband would have expired anyway. The list never grows forever.
Stopping password guessers
What if someone tries to break in by guessing passwords over and over?
After 5 wrong attempts, the account is locked for 15 minutes. That makes guessing painfully slow. On top of that, sensitive pages like sign-up are limited to about 10 attempts per minute from the same source, which blocks automated bots from hammering the door.
Admins get an extra layer: they must also enter a six-digit code from an authenticator app on their phone (two-factor authentication). A stolen admin password alone isn't enough.
VIP rooms: who is allowed where
Getting into the event is one thing. Getting into the VIP lounge or the backstage area is another. That depends on what kind of pass you have.
Web3 Broadcast has five kinds of users, and each can do different things:
- Individual: regular users who join airdrops and apply for jobs.
- Publisher: writers who can post articles.
- Project Owner: Web3 teams who can post jobs, airdrops, events, and more. Their email must match their project's website domain, so random people can't pretend to represent a company.
- Researcher: invite-only accounts for publishing research.
- Admin: people who run the platform.
Each door in the system has a sign saying which passes are allowed. A guard at that door checks your wristband's pass type, and if you don't match, you're politely turned away. This is called role-based access control, and it means permissions are enforced in one consistent place rather than scattered around the code.
Uploading files without a traffic jam
Users upload things like profile pictures and project logos. The obvious approach is for your browser to send the file to our server, and our server to pass it on to cloud storage. But that makes our server a middleman for every large file, which slows everything down.
Instead, the server hands your browser a one-time delivery permit, called a pre-signed URL. It's like a courier label that says: "This person may drop off one image, of this exact type, up to 5 MB, within the next hour." Your browser then sends the file straight to cloud storage, skipping our server entirely. If you try to send the wrong file type or something too large, storage rejects it.
The takeaway
Good security isn't one big lock. It's a series of small, sensible habits: wristbands that expire quickly, claim tickets that only work once, a list of cancelled wristbands, limits on guessing, clear rules for who can go where, and never letting big files clog up the main entrance. Each one on its own is simple. Together, they make the platform a lot harder to abuse.