Shortesh Kon
A fast, lightweight URL shortener with write-behind caching & 127 Vitest tests
Full-Stack Developer
2026
Web Dev
9 Technologies
URL Shortening, Instant Redirects & Analytics Flow
Test the complete URL shortening lifecycle: input destination URLs, configure flexible expiration windows, inspect deterministic slug generation, and observe write-behind analytics tracking.
Testing & Walkthrough Guide
- 1Paste any destination URL into the shortener input field.
- 2Choose an optional expiration timeframe (1 hour, 24 hours, 7 days, 30 days, or permanent).
- 3Receive your unique short code and downloadable QR code.
- 4Open the short link to experience low-latency Redis-cached redirection routing.
- 5Inspect accumulated click metrics and domain analytics updated via atomic in-memory counters.
About This Project
A production-grade link shortener designed around high throughput, sub-millisecond redirects, and clean system design. Built with Next.js 16, React 19, TypeScript, PostgreSQL 16, Drizzle ORM, and Upstash Redis. Features write-behind caching for fast redirects, atomic click counters, collision-free codes via Feistel cipher + Sqids, bilingual English/Persian support, and SSRF protection.
Key Features & Capabilities
Write-Behind Caching & Sub-Millisecond Redirects
Redirects are served straight from Redis memory with near-zero latency, while clicks are buffered in memory and batched to PostgreSQL.
Deterministic Collision-Free Slugs (Feistel + Sqids)
Maps database IDs bijectively through a 32-bit Feistel cipher into Sqids, ensuring every short code is unique, mathematically collision-free, and non-sequential without retry loops.
Full English & Persian Localization
Native RTL and LTR layout switching, Jalali (Shamsi) calendar dates, Persian numerals, and automatic system language preference detection.
Multi-Layer Security & SSRF Protection
Guards against SSRF by blocking private network CIDRs and cloud metadata IPs at the DNS level, paired with Redis IP rate-limiting and strict Zod validation.
Guest Mode & User Accounts
Shorten links instantly as a guest with local storage tracking, or log in to manage, organize, and monitor active link lifecycles.
Live Analytics & Instant QR Codes
Interactive charts tracking click volumes, top referring domains, and link statuses, paired with instant downloadable SVG and PNG QR codes.
Technical Architecture & Stack
Built on Next.js 16 App Router with React 19 and strict TypeScript. Redirection paths bypass database lookups by reading directly from Upstash Redis. High-frequency click counts are incremented via atomic Redis commands, then batched into PostgreSQL 16 via Drizzle ORM using a cron worker guarded by distributed locks. Domain logic is cleanly separated using the Data Access Layer (DAL) and Result Pattern.
Key Technical Highlights
- Next.js 16 App Router architecture with React 19 server and client components
- Write-behind caching pattern combining Upstash Redis in-memory buffering and PostgreSQL persistence
- Atomic HINCRBY click tracking with distributed lock-protected cron synchronization
- 32-bit bijective Feistel permutation producing collision-free Sqids without DB collision checks
- Strict Data Access Layer (DAL) and Result Pattern pairing business logic with clear inline documentation
- Comprehensive 127-test Vitest suite covering edge cases, expired links, and security boundaries
Frontend & UI
Backend & Data Layer
Security & Validation
Testing & Tooling
Key Engineering Challenges & Solutions
Handling high-frequency redirect traffic and click tracking without overwhelming relational database connection pools.
Adopted a write-behind caching architecture: redirects read directly from Upstash Redis, clicks are tallied in memory with atomic HINCRBY, and a scheduled cron job syncs data to PostgreSQL in batches under a distributed lock.
Preventing sequential ID scraping while guaranteeing collision-free short codes without costly database lookup-and-retry loops.
Implemented a 32-bit bijective Feistel cipher permutation that scrambles auto-incrementing IDs into pseudorandom numbers before encoding them with Sqids, guaranteeing mathematically collision-free codes in O(1) time.
Mitigating Server-Side Request Forgery (SSRF) and abuse on public URL shortening endpoints.
Enforced multi-layer defense: DNS resolution filtering to block loopback, private RFC-1918 subnets, and cloud metadata IPs (e.g. 169.254.169.254), coupled with Redis IP rate-limiting and Zod validation.
Deep Dive: Write-Behind Caching in Practice
When a short link is requested at /{slug}, every millisecond matters. In standard URL shorteners, an incoming HTTP GET executes:
- An incoming connection to PostgreSQL
SELECT destination_url FROM links WHERE slug = $1- An
UPDATE links SET clicks = clicks + 1 WHERE id = ... - An HTTP 302/307 redirect
Under peak load, the relational database connection pool is immediately exhausted, adding latency spikes to every user click.
The Upstash Redis Solution
In Shortesh Kon:
- Redirection Reads: The short slug is queried from Upstash Redis via
GET link:{slug}. If cached, the HTTP 307 redirect returns in under 5ms. - Write-Behind Batching: Rather than executing an
UPDATEstatement per redirect, the click is registered with an atomic RedisHINCRBY link:clicks {id} 1. - Cron Worker Flush: A scheduled job synchronizes the batched counters to PostgreSQL in transactions protected by Upstash distributed locks.