Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
•
Sicherheitslücken (CVE)USN-8821-1: OpenStack Swift vulnerability(24.09.2026 um 21:18 Uhr)
•
Sicherheitslücken (CVE)USN-8820-1: curl vulnerabilities(24.09.2026 um 22:13 Uhr)
•
Linux Tipps & HardeningDSA-6512-1 libreoffice - security update(24.09.2026 um 02:00 Uhr)
••••••••
Sicherheitslücken (CVE)USN-8821-1: OpenStack Swift vulnerability(24.09.2026 um 21:18 Uhr)
•
Sicherheitslücken (CVE)USN-8820-1: curl vulnerabilities(24.09.2026 um 22:13 Uhr)
•
Linux Tipps & HardeningDSA-6512-1 libreoffice - security update(24.09.2026 um 02:00 Uhr)
•••••••
Intelligence View
⚡ tsecurity.de Intelligence

Building a High-Performance Link Shortener with Next.js 16, Supabase, and Edge Functions

At CouponSwift, we process a lot of traffic. When we decided to replace our legacy link management tools, we had two requirements: Speed and Privacy. We built WiseURL, an open-source link manager. Here is the technical breakdown of how we…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

At CouponSwift, we process a lot of traffic. When we decided to replace our legacy link management tools, we had two requirements: Speed and Privacy.



We built WiseURL, an open-source link manager. Here is the technical breakdown of how we built it tailored for the modern web.






The Architecture



The application is split into two parts:





  1. The Dashboard: A standard Next.js App Router application (Server Components) for managing links, viewing analytics, and handling auth.


  2. The Redirect Engine: An ultra-lightweight Edge Route handling the high-traffic redirection logic.






1. The Database Schema (Supabase)



We keep it simple. We use PostgreSQL via Supabase. The core is just two tables: links and clicks.




-- The core links table
create table links (
id uuid default gen_random_uuid() primary key,
code text unique not null, -- The slug (e.g. 'hostgator')
destination_url text not null,
is_active boolean default true,
group_id uuid references groups(id), -- For organizing campaigns
created_at timestamp with time zone default timezone('utc'::text, now())
);

-- The analytics table
create table clicks (
id uuid default gen_random_uuid() primary key,
link_id uuid references links(id),
country text, -- e.g. "US"
city text,
device_type text, -- "mobile", "desktop"
os_name text,
browser_name text,
created_at timestamp with time zone default timezone('utc'::text, now())
-- NOTICE: No IP address column!
);









2. The Edge Redirect (The Fun Part)



We barely use Node.js for the redirects. Instead, we use the Edge Runtime. This allows the code to run on Vercel's or Netlify's global edge network, closer to the user.



In src/app/[code]/route.ts, we force the runtime:




import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'

export const runtime = 'edge' // <--- The magic keyword

export async function GET(request: NextRequest, { params }: Params) {
const { code } = params
const supabase = createClient()

// 1. Fast Lookup
const { data: link } = await supabase
.from('links')
.select('destination_url, id')
.eq('code', code)
.single()

if (!link) return new NextResponse('Not Found', { status: 404 })

// 2. Async Analytics (Non-blocking)
// We extract geo data from headers injected by the hosting provider
const country = request.headers.get('x-vercel-ip-country') || 'XX'

// Fire and forget - don't await this!
saveClickAnalytics(link.id, country, request.headers.get('user-agent'))

// 3. Instant Redirect
return NextResponse.redirect(link.destination_url, { status: 302 })
}






(Code simplified for readability)






Why Edge?



Using the Edge Runtime reduces the "Cold Start" problem significantly compared to standard Serverless functions. For an affiliate link, every millisecond of delay drops conversion rates.






3. Solving the Privacy Dilemma



We wanted analytics (to know if our US traffic works better than UK traffic), but we didn't want to store PII (Personally Identifiable Information).



The solution was simple: Header Extraction.



hosting providers (Netlify/Vercel) resolve the IP to a location before the request hits our code. They pass x-vercel-ip-country or x-nf-geo-country-code headers.



We read these headers, store the string "US" or "London", and then discard the request data. The IP never touches our database.






Conclusion



WiseURL has allowed us to own our infrastructure at CouponSwift without maintaining a complex VPS. It scales infinitely on serverless, costs $0 on the free tiers for our volume, and keeps our data private.



It is 100% open source. You can fork it, deploy it, and use it for your own campaigns.



Repo: github.com/netwisemedia/wiseurl

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Building a High-Performance Link Shortener with Next.js 16, Supabase, and Edge Functions
id: 53b46d45-a712-4e2d-af7c-a00ff450ee0e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Building a High-Performance Li" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Building a High-Performance Link Shorten")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Building a High-Performance Link Shorten*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Building a High-Performance Link Shorten"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Building a High-Performance Link Shorten.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Building a High-Performance Link Shortener with Next.js 16, Supabase, and Edge Functions

Thematisch verwandte Begriffe: Building, HighPerformance, Link, Shortener · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-81473 | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an …
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle