๐ง๐๐ผ ๐๐๐ด๐ ๐ง๐ต๐ฎ๐ ๐ง๐ฎ๐๐ด๐ต๐ ๐ ๐ฒ ๐ ๐ผ๐ฟ๐ฒ ๐ง๐ต๐ฎ๐ป ๐๐ป๐ ๐ง๐๐๐ผ๐ฟ๐ถ๐ฎ๐น
I learned more from two bugs than from any tutorial. These errors showed me the gap between how tools work and how I thought they worked.
Bug 1: The PKCE State Failure
I built a CLI tool for GitHub authorization. The flow worked like this:
- The CLI generates a verifier and a challenge.
- It opens a browser with the challenge in a state parameter.
- The user authorizes on GitHub.
- GitHub redirects to a local callback with a code.
- The CLI exchanges the code and verifier for tokens.
The code broke during deployment. I used the state parameter to find the verifier in my database. I assumed the state would stay consistent. I learned that you cannot trust every external parameter to behave the same way in production as it does on your machine.
Bug 2: The Argon2 Hashing Error
I worked on a team project to handle user sessions. Here was my mistake:
- I hashed a refresh token using Argon2.
- I tried to find the session in the database by searching for the hashed token.
This failed every time. Argon2 is non-deterministic. This means the same input produces a different hash every single time. You cannot use a hashed value in a database query to find a record.
How I fixed it:
- I embedded a unique tokenId in the JWT.
- I saved the tokenId and the hashed token in the database.
- To refresh a session, I first look up the session by the tokenId.
- Then I use Argon2.verify to check if the incoming token matches the stored hash.
The Lesson
Both bugs shared a pattern. The code looked correct. The local tests passed. The failures happened because of my assumptions about how libraries function.
Argon2 documentation explains its behavior. However, you do not feel the risk until you use it incorrectly.
Do not just read documentation. Build a habit of asking one question before you trust a library:
"What assumptions am I making about this tool?"
Asking this question saves more debugging time than any other skill I have learned during my internship.
Source: https://dev.to/clinztouch/two-bugs-that-taught-me-more-than-any-tutorial-2jh7