I Built a Pixiv Alternative in Go (and Taught It SEO)
Описание и применение
Создана платформа для иллюстраций, использующая Go и React SPA, с улучшенной SEO через бот‑пререндеринг, IndexNow, клиентскую обработку изображений и усиленную безопасность аутентификации.
Задача
Building an illustration community platform that is SEO‑friendly while maintaining a SPA architecture and secure upload/auth flows.
Результат
The platform achieved SEO visibility for a SPA, reduced bandwidth costs via client‑side downsampling, and hardened security for uploads and authentication.
Рабочий процесс
- 1. Detect Googlebot UA and serve pre‑rendered HTML with title, meta, OG, JSON‑LD.
- 2. On artwork publish, send IndexNow ping to Bing/Yandex.
- 3. Generate sitemap.xml and robots.txt.
- 4. Validate uploads via magic‑byte, reject absurd dimensions, downsample on client to ~800KB WebP before upload.
- 5. Store uploads in Cloudinary, avoiding large server‑side files.
- 6. Use bcrypt with dummy‑hash for timing attack protection.
- 7. Issue JWT (HS256) with Redis‑backed revocation and password‑change epoch.
- 8. Apply rate limiting, account lockout, generic error messages.
- 9. Use Sqids for artwork URLs.
- 10. Deploy and monitor SEO performance.
Доказательства
I implemented bot pre-rendering: when the user-agent smells like Googlebot, the server returns fully rendered HTML with real <title>, meta/OG tags, and JSON-LD structured data per artwork — instead of an empty <div id="root">.
Every artwork publish fires an IndexNow ping, so Bing/Yandex learn about new content in minutes instead of weeks.
Magic-byte validation — never trust the extension or the Content-Type header.
Client-side downsampling — a Canvas GPU pipeline shrinks 10–20 MB master illustrations to ~800 KB WebP before network transit.
bcrypt with constant-time dummy-hash execution so username enumeration via timing attacks doesn't work.
Artwork URLs use Sqids hash IDs (/artwork/v06sDC) instead of sequential integers.
- Дата записи: 2026-10-18T04:41:01.427Z