01
Ping
Real-time messaging platform
Client
Next.js
TypeScript
Server
Spring Boot
Java
Data
MongoDB
- Access control fails closed
- Hardened media uploads
- 26 JUnit tests
- The product
- A full-stack messaging app with live chat, presence and read receipts.
- The problem
- Chat only feels real if messages, presence and receipts arrive instantly. A messaging app also holds private conversations and user-uploaded files, so access has to be airtight.
- My role
- Full stack: Spring Boot and MongoDB on the backend, Next.js and TypeScript on the client.
Built with: Java · Spring Boot · MongoDB · WebSocket / STOMP · JWT · Next.js · TypeScript · JUnit
Decisions and details for Ping
Key decisions
- JWT-secured REST APIs for request/response work.
- WebSocket with STOMP for everything that has to be live: messages, presence and read receipts.
- Access controls that fail closed. If access can't be confirmed, the request is refused.
- A security-hardened pipeline for media uploads.
- 26 JUnit tests covering the upload pipeline and access rules.
The hard part
File uploads are one of the easiest ways into an application. The upload pipeline was hardened and the access rules fail closed, with tests behind both.




