Project Overview

Kolo Kept is a digital savings application, much like a piggy bank with vault grade locks. Users create savings vaults, deposit and withdraw funds in real time, and track progress toward their savings goals. The entire experience is built around one principle: security should never be an afterthought. Every login, every signup, and every password reset is protected by multiple independent layers of defense. The result is a fintech style application where the authentication system alone implements rate limiting, account lockout, email enumeration prevention, and cookie based session management, all without compromising on user experience.

The Tech Stack and Tools

Framework: Next.js 15 (App Router)

Language: TypeScript 5

UI: React 19, Tailwind CSS 3, Lucide React icons

Database: PostgreSQL via Supabase

Auth: Supabase Auth, @supabase/ssr

Rate Limiting and Lockout: Upstash Redis and Upstash Ratelimit

Validation: Zod 4

Tooling: PostCSS, Autoprefixer

The Challenge and Strategy

Authentication in financial applications is a highly critical problem. The challenge was to build a login system that resists brute force attacks, credential stuffing, and email enumeration without relying on an external auth wall like Auth0 or Clerk that would lock the project into a fixed pricing tier.

The strategy was defense in depth. Instead of a single gatekeeper, every auth endpoint was wrapped in multiple independent checks. Zod validation rejects malformed input immediately. Redis based rate limiting throttles abusive IPs before they reach the database. An account lockout counter per email prevents targeted brute force attacks even from rotating IPs. Finally, all server actions use Supabase SSR cookie based sessions for secure, browser managed credential storage.

Technical Implementation

The auth module was split into five focused server actions (login, signup, password reset, update password, logout), each with its own validation schema and rate limiter. Redis stores two kinds of state: sliding window rate limit counters (5 attempts per 15 minutes for login, 3 per 30 minutes for password reset) and an account lockout counter per email with a threshold of 10 failures and a 1 hour expiry.

Three separate Supabase clients were created following the principle of least privilege: an anonymous browser client for public reads, a cookie based server client for authenticated server actions, and a service role admin client restricted to user provisioning triggers. Row Level Security is enabled on all database tables, and a database trigger automatically provisions a profile and vault row for every new user at signup. The auth callback handler processes verification tokens on the client and syncs them seamlessly with Supabase's cookie based server client, ensuring secure session persistence that survives full page navigations.

Technical Result

A fully functional, production ready savings application where authentication is resilient to automated attacks. The login endpoint runs four sequential security checks before granting access, the password reset flow is rate limited and immune to enumeration, and account lockout automatically resets after one hour or upon successful password reset.

You can explore the live application here: https://kolo-kept-woad.vercel.app/

#Nextjs #TypeScript #Supabase #WebDevelopment #CyberSecurity #SoftwareEngineering #BuildInPublic #Fintech #React