Maruf Ahmed
Open to frontend roles · Remote / relocating · Dhaka, GMT+6
Frontend engineer building real-time, identity-heavy and data-intensive web applications.
React · Next.js · TypeScript · SIP.js/WebRTC · Go
6 years building production React · Dhaka, GMT+6
Proof, not claims
Authentication
Silent token refresh visualiser
Fire concurrent requests, watch them all 401, watch the queue collapse into one refresh.Interactive demo
Authorization
RBAC playground
Switch roles and watch navigation and route guards update from one permission map.Interactive demo
Real-time
Browser softphone architecture
How a SIP.js softphone handles registration, call state and teardown inside a web app.Case study
Selected work
All case studiesCase study
A token the browser never holds
Frontend Engineer · frontend architecture owner
Auth, RBAC and the data layer for a multi-tenant support platform, designed so the browser holds no credential and navigation cannot disagree with its guards.Case study
A phone that lives in the browser
Frontend Engineer · softphone and real-time
A SIP.js softphone inside a support console: registration lifecycle, call state and teardown handled in the browser, with no desktop client to install.
Recent writing
All postsRBAC that can't drift
5 min read
When navigation and route guards are written separately, they disagree. Derive both from one permission map and the disagreement becomes impossible.- auth
- architecture
- react
Collapsing concurrent 401s into a single refresh
5 min read
When a token expires mid-page, every in-flight request fails at once. Queue them behind one refresh instead of firing one per failure.- auth
- react
- typescript
Your React app should never hold an auth token
5 min read
Access tokens in JavaScript are readable by any script on the page. A thin backend-for-frontend removes the problem instead of managing it.- auth
- react
- architecture