Rules Hub
Coding Rules Library
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Don't cache or reuse URLs that carry an expiring access token
A fallback URL used as a long-lived cache key must not embed a short-lived token, or the cached result breaks once the token expires.
Bad example
| 1 | function getCacheableImageUrl(asset: Asset) { |
| 2 | // asset.previewUrl looks like: https://storage.example.com/img.png?accessToken=abc123 |
| 3 | return asset.previewUrl; |
| 4 | } |
Explanation (EN)
The URL is used verbatim as a cache key by a downstream image-scaling/derivative service. Once `accessToken` expires, the origin request 403s, but the already-cached derivative keeps being served (or a new fetch fails), producing a permanently broken image with no further error.
Objašnjenje (HR)
URL se doslovno koristi kao ključ za cache u servisu koji generira derivate slike. Kad `accessToken` istekne, izvorni zahtjev vraća 403, ali već keširani derivat se i dalje servira (ili novi dohvat ne uspije), što rezultira trajno pokvarenom slikom bez ikakve daljnje greške.
Good example
| 1 | function getCacheableImageUrl(asset: Asset) { |
| 2 | // prefer a stable URI that doesn't carry an expiring credential |
| 3 | return asset.stableUri ?? stripExpiringToken(asset.previewUrl); |
| 4 | } |
Explanation (EN)
Anything that will be cached or reused long-term should be a stable identifier, not a URL with an embedded expiring credential — strip the token or resolve a permanent URI before handing it to a cache.
Objašnjenje (HR)
Sve što će se dugoročno keširati ili ponovno koristiti treba biti stabilan identifikator, a ne URL s ugrađenom kredencijalom koja ističe — token treba ukloniti ili razriješiti trajni URI prije predaje cacheu.
Exceptions / Tradeoffs (EN)
Fine for short-lived, request-scoped use where the URL is never cached beyond the token's own lifetime.
Iznimke / Tradeoffi (HR)
U redu je za kratkotrajnu upotrebu unutar jednog zahtjeva, gdje se URL nikad ne kešira dulje od životnog vijeka samog tokena.