# Web Application Domain

## Approach
- Separate routing, handlers, services, repositories.
- Validate all input at the boundary; never trust client data.
- Use middleware for auth, logging, CORS, rate limiting.
- Database migrations versioned; connection pooling.
- Server-rendered or SPA with clear API contract.

## Common Patterns
- REST resource controllers (CRUD).
- JWT/session auth with refresh tokens.
- Repository pattern over SQL.
- Background jobs / queues.
- WebSocket for realtime; SSE for one-way.

## Testing
- Unit: services, repositories (test DB).
- Integration: HTTP endpoints (supertest/axum-test).
- E2E: Playwright/Cypress.
- Load: k6/vegeta.

## Pitfalls
- N+1 queries, missing indexes.
- CSRF/XSS on server-rendered apps.
- File upload abuse (size/type/path traversal).
- Session fixation, weak passwords.
- CORS misconfiguration.
- Rate limiting gaps on public endpoints.
"