Work / Community platform / 2023
Anyonyam
A full-stack web platform for a local community initiative, with accounts protected by JWT sessions and OTP sign-in.
The boundary
Stays inside
- Member records in MySQL
- Signing secret for tokens
- OTP issuing and checks
Allowed to cross
- Signed JWTs on each request
- One-time codes to a verified contact
No one writes to the community without proving who they are.
Context
A local community needed one place to organise people and information, run by volunteers rather than an IT team.
Idea
Keep it a plain, dependable full-stack app and spend the effort where trust matters: who can sign in and who can change data.
Craft
- React front end on a Node.js and Express API.
- MySQL behind full create, read, update and delete flows for the community data.
- JWT sessions plus OTP sign-in, so accounts are not one password away from takeover.
Threat model
| Asset | Threat | Control |
|---|---|---|
| Member accounts | Credential stuffing | OTP sign-in on top of tokens |
| Community data | Unauthenticated writes | Signed JWT required on every write route |
Outcome
Live at anyonyam.in for the community it was built for.