Engineering notes
What we learned building TheLoops, written for developers: Django, Channels, WebSockets and FFmpeg. Each note describes behaviour we measured, and the code is what runs in production.
Our Django test suite was waiting, not working
A 4,660-test suite went from 9m38s to 57s without parallelism. Comparing user with real time found seven minutes of PBKDF2 password hashing, HTTP clients sitting out production timeouts, and deliberate pauses nobody turned down; then xdist exposed a leak the serial order had hidden.
Note · 2026-11-10
channels-jwt-subprotocol: JWT auth for Django Channels WebSockets
An MIT-licensed middleware and consumer mixin that read a JWT from the Sec-WebSocket-Protocol header, validate it with SimpleJWT, echo only the marker, and refuse with a close code that actually reaches the browser. Tested against live Daphne and Uvicorn.
Open-source library · 2026-11-10
Django Channels: JWT auth without the token in the URL
Why a WebSocket token should travel as a subprotocol rather than a query string, why a close code sent before accept() becomes an HTTP 403, and what nginx and an idle timeout do to the connection.
Note · 2026-11-09
Also open source: ffmpeg-tee-builder, which builds FFmpeg's -f tee arguments so one dead RTMP server cannot stop the other outputs.
Follow new notes with the RSS feed. It carries developer notes only, no product announcements.