.tip

Jul 2, 2026 · one of the small things

Four log levels, with a rule for each

error means a person should look, today. warn means something degraded and recovered on its own, worth a count on a dashboard. info is the narrative of a request at one line per meaningful step. debug is off in production.

If error fires a hundred times an hour on a healthy system it has stopped meaning anything. Downgrade until the error log is quiet on a normal day, then alert on it.

observability

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close