Priya Nandakumar

Tokens and schedules — JWT verification, cron semantics

Priya covers the two places where a system trusts something it did not compute: a token it was handed, and a schedule it was configured with.

Both fail quietly. A JWT whose signature nobody checked decodes exactly like one that was verified, and a cron expression with the wrong field count runs on a timetable nobody intended. The pages under this byline spend their length on the step that catches it rather than on the syntax.

The cron work leans on running the expressions and reading back what the parser matched, since the day-of-month and day-of-week fields are OR-ed rather than AND-ed and no amount of reading the line aloud makes that visible.

What this byline is strict about

• Verify before you read a claim out of a payload
• Print what the parser matched, not what the expression looks like it says
• Give the timezone the run actually used

12 posts under this byline

• 

  Cron Field Count — A Six-Field Expression Still Installs, and Runs Wrong

  crontab reads five fields and calls the rest the command, so a six-field Spring expression installs and runs on a different schedule entirely.

  Oct 17, 2026·7 min readScheduling

• 

  JWT Segments: The Header Decodes Everywhere, the Payload Does Not

  The 27-byte header decodes in every runtime; seven of eleven standard-library calls fail on the payload or signature of the same token.

  Oct 13, 2026·7 min readAnatomy

• 

  Cron vs systemd Timers — What You Get for the Extra Files

  Two files instead of one line, in exchange for logging, missed-run catch-up and arbitrary intervals.

  Sep 6, 2026·6 min readComparison

• 

  JWT Refresh Tokens: Getting Revocation Back

  The split that buys revocation back, why the refresh token should not be a JWT, and what rotation detects.

  Sep 6, 2026·8 min readAuth

• 

  Cron and Timezones — The Two Days a Year It Goes Wrong

  Local time means an hour vanishes each spring and repeats each autumn. CRON_TZ and the UTC fix.

  Sep 2, 2026·6 min readScheduling

• 

  Where to Store a JWT: httpOnly Cookie vs localStorage

  localStorage is readable by every script; an httpOnly cookie is not — and is sent automatically.

  Sep 2, 2026·7 min readSecurityComparison

• 

  Cron Every 5 Minutes — And Why */45 Does Not Do What You Think

  */5 works, but a step that does not divide 60 restarts hourly — */45 fires 45 minutes apart, then 15.

  Sep 1, 2026·6 min readScheduling

• 

  JWT vs Session Cookies: The Revocation Problem

  43 bytes and revocable versus 324 bytes and not. The revocation problem and the refresh-token split.

  Sep 1, 2026·6 min readComparison

• 

  Crontab Syntax — The Five Fields, Explained with Real Run Times

  The five fields, what each accepts, step-value semantics, and common expressions with their real next run times.

  Aug 31, 2026·8 min readScheduling

All jwt guides →All cron guides →

Withuse publishes under three bylines, listed on the authors page. Each one owns a beat and is answerable for it; none of them claims an employer, a degree or a job history, because none of that is what makes a page on this site worth trusting. What does is on the about page: every claim is run before it is written, the runtime version is named, and corrections are dated and kept.