Forem: Rajat Sharma

OOP in C++ Explained: IS-A vs HAS-A Relationship (Inheritance vs Composition Guide)

Rajat Sharma — Thu, 12 Feb 2026 12:57:31 +0000

OOP Relationships in C++: IS-A vs HAS-A (Inheritance vs Composition)

This comprehensive guide explains the two most important object-oriented relationships:

IS-A relationship → Inheritance
HAS-A relationship → Composition

Understanding this is critical for:

C++ OOP
Java OOP
System design
Backend architecture
LLD interviews

IS-A Relationship (Inheritance)
HAS-A Relationship (Composition)
Composition vs Aggregation
Key Differences
Design Principles
Real-World Examples
Common Mistakes
Interview Questions

1. IS-A Relationship (Inheritance)

Definition

An IS-A relationship means a child class is a specialized type of parent class. The child class inherits properties and behaviors from the parent class.

Litmus Test: If this sentence makes grammatical and logical sense:

"Child is a Parent"

then inheritance is the correct choice.

Examples

Child Class	Parent Class	Sentence Test
Dog	Animal	"Dog is an Animal" ✅
Car	Vehicle	"Car is a Vehicle" ✅
Circle	Shape	"Circle is a Shape" ✅
Manager	Employee	"Manager is an Employee" ✅
IndianTax	TaxCalculator	"IndianTax is a TaxCalculator" ✅

Basic Syntax (C++)

#include <iostream>
using namespace std;

class Parent {
public:
    void show() {
        cout << "Parent function" << endl;
    }
};

class Child : public Parent {
public:
    void display() {
        cout << "Child function" << endl;
    }
};

int main() {
    Child c;
    c.show();      // Inherited from Parent
    c.display();   // Child's own method
    return 0;
}

Output:

Parent function
Child function

Note: Child inherits all public/protected members of Parent.

Types of Inheritance

1. Single Inheritance

One child inherits from one parent.

class Animal {
public:
    void eat() { cout << "Eating..." << endl; }
};

class Dog : public Animal {
public:
    void bark() { cout << "Barking..." << endl; }
};

2. Multiple Inheritance

One child inherits from multiple parents.

class Flyable {
public:
    void fly() { cout << "Flying..." << endl; }
};

class Swimmable {
public:
    void swim() { cout << "Swimming..." << endl; }
};

class Duck : public Flyable, public Swimmable {
public:
    void quack() { cout << "Quacking..." << endl; }
};

3. Multilevel Inheritance

Chain of inheritance (Grandparent → Parent → Child).

class Animal {
public:
    void eat() { cout << "Eating..." << endl; }
};

class Mammal : public Animal {
public:
    void breathe() { cout << "Breathing..." << endl; }
};

class Dog : public Mammal {
public:
    void bark() { cout << "Barking..." << endl; }
};

4. Hierarchical Inheritance

Multiple children inherit from one parent.

class Shape {
public:
    virtual double area() = 0;
};

class Circle : public Shape {
    double radius;
public:
    Circle(double r) : radius(r) {}
    double area() override { return 3.14159 * radius * radius; }
};

class Rectangle : public Shape {
    double width, height;
public:
    Rectangle(double w, double h) : width(w), height(h) {}
    double area() override { return width * height; }
};

Why Use Inheritance?

1. Code Reuse

Child automatically gets parent properties and methods without rewriting code.

class Vehicle {
protected:
    string brand;
    int speed;
public:
    void start() { cout << "Vehicle started" << endl; }
    void stop() { cout << "Vehicle stopped" << endl; }
};

class Car : public Vehicle {
    int numDoors;
public:
    // Car automatically has start(), stop(), brand, speed
    void honk() { cout << "Beep beep!" << endl; }
};

class Motorcycle : public Vehicle {
    bool hasSidecar;
public:
    // Motorcycle also has start(), stop(), brand, speed
    void wheelie() { cout << "Doing a wheelie!" << endl; }
};

2. Runtime Polymorphism

Allows different behavior using the same interface through virtual functions.

class Animal {
public:
    virtual void sound() = 0;  // Pure virtual function
    virtual ~Animal() {}       // Virtual destructor
};

class Dog : public Animal {
public:
    void sound() override {
        cout << "Dog barks: Woof!" << endl;
    }
};

class Cat : public Animal {
public:
    void sound() override {
        cout << "Cat meows: Meow!" << endl;
    }
};

class Cow : public Animal {
public:
    void sound() override {
        cout << "Cow moos: Moo!" << endl;
    }
};

// Usage - Polymorphism in action
int main() {
    Animal* animals[3];
    animals[0] = new Dog();
    animals[1] = new Cat();
    animals[2] = new Cow();

    // Same function call → different behavior
    for (int i = 0; i < 3; i++) {
        animals[i]->sound();
    }

    // Cleanup
    for (int i = 0; i < 3; i++) {
        delete animals[i];
    }
    return 0;
}

Output:

Dog barks: Woof!
Cat meows: Meow!
Cow moos: Moo!

3. Extensibility

Easy to add new types without modifying existing code (Open/Closed Principle).

// Adding a new animal is easy - just create a new class
class Lion : public Animal {
public:
    void sound() override {
        cout << "Lion roars: Roar!" << endl;
    }
};
// No changes needed to existing code!

Inheritance Access Specifiers

class Base {
public:
    int publicVar;
protected:
    int protectedVar;
private:
    int privateVar;
};

Access Specifier	public members	protected members	private members
`public` inheritance	public in derived	protected in derived	not accessible
`protected` inheritance	protected in derived	protected in derived	not accessible
`private` inheritance	private in derived	private in derived	not accessible

Access Comparison Table

Access Type	External Code	Derived Class
`public`	✅ Accessible	✅ Accessible
`protected`	❌ Not accessible	✅ Accessible
`private`	❌ Not accessible	❌ Not accessible

When to Use Inheritance

Correct Usage ✅

Statement	Why It Works
Dog IS-A Animal	Logical type hierarchy
Manager IS-A Employee	Manager is specialized Employee
SavingsAccount IS-A BankAccount	Specialized account type
ElectricCar IS-A Car	Specialized car type

Wrong Usage ❌

Statement	Why It's Wrong
Car IS-A Engine	Car contains engine, not a type of engine
Invoice IS-A TaxCalculator	Invoice uses tax calculator
House IS-A Room	House contains rooms
Computer IS-A CPU	Computer contains CPU

2. HAS-A Relationship (Composition)

Definition

A HAS-A relationship exists when a class contains or uses another class as a member. The containing class is composed of other objects.

Litmus Test: If this sentence makes sense:

"Class A has a Class B"

then composition is the correct choice.

Examples

Container Class	Contained Class	Sentence Test
Car	Engine	"Car has an Engine" ✅
Computer	CPU	"Computer has a CPU" ✅
House	Room	"House has Rooms" ✅
Order	Payment	"Order has a Payment" ✅
Person	Address	"Person has an Address" ✅

Basic Syntax

Object Composition (Strong Ownership)

class Engine {
public:
    void start() {
        cout << "Engine started" << endl;
    }
    void stop() {
        cout << "Engine stopped" << endl;
    }
};

class Car {
private:
    Engine engine;   // HAS-A relationship (composition)
    string model;

public:
    Car(string m) : model(m) {}

    void startCar() {
        cout << "Starting " << model << "..." << endl;
        engine.start();
    }

    void stopCar() {
        engine.stop();
        cout << model << " stopped" << endl;
    }
};

int main() {
    Car myCar("Tesla Model 3");
    myCar.startCar();
    myCar.stopCar();
    return 0;
}

Output:

Starting Tesla Model 3...
Engine started
Engine stopped
Tesla Model 3 stopped

Pointer Composition (Dynamic/Flexible)

class Engine {
    int horsepower;
public:
    Engine(int hp) : horsepower(hp) {}
    void start() { cout << "Engine (" << horsepower << " HP) started" << endl; }
    int getPower() { return horsepower; }
};

class Car {
private:
    Engine* engine;    // Pointer-based composition
    string model;

public:
    Car(string m, int hp) : model(m) {
        engine = new Engine(hp);
    }

    ~Car() {
        delete engine;  // Clean up owned resource
    }

    void start() {
        cout << "Starting " << model << endl;
        engine->start();
    }
};

Modern C++ with Smart Pointers (Recommended)

#include <memory>

class Engine {
public:
    void start() { cout << "Engine started" << endl; }
};

class Car {
private:
    unique_ptr<Engine> engine;  // Automatic memory management
    string model;

public:
    Car(string m) : model(m), engine(make_unique<Engine>()) {}

    void start() {
        cout << "Starting " << model << endl;
        engine->start();
    }
    // No destructor needed - smart pointer handles cleanup
};

Composition with Dependency Injection

This is the preferred approach in professional software development.

// Interface (Abstract class)
class IEngine {
public:
    virtual void start() = 0;
    virtual void stop() = 0;
    virtual ~IEngine() {}
};

// Concrete implementations
class PetrolEngine : public IEngine {
public:
    void start() override { cout << "Petrol engine: Vroom!" << endl; }
    void stop() override { cout << "Petrol engine stopped" << endl; }
};

class ElectricEngine : public IEngine {
public:
    void start() override { cout << "Electric engine: Whirr..." << endl; }
    void stop() override { cout << "Electric engine stopped" << endl; }
};

// Car depends on interface, not concrete implementation
class Car {
private:
    IEngine* engine;  // Dependency injection
    string model;

public:
    // Engine is injected from outside
    Car(string m, IEngine* e) : model(m), engine(e) {}

    void start() {
        cout << "Starting " << model << endl;
        engine->start();
    }

    void stop() {
        engine->stop();
    }
};

int main() {
    PetrolEngine petrol;
    ElectricEngine electric;

    Car gasCar("Honda Civic", &petrol);
    Car evCar("Tesla Model 3", &electric);

    gasCar.start();
    evCar.start();

    return 0;
}

Output:

Starting Honda Civic
Petrol engine: Vroom!
Starting Tesla Model 3
Electric engine: Whirr...

3. Composition vs Aggregation

Both are HAS-A relationships but differ in ownership semantics.

Composition (Strong Ownership)

Lifetime dependency: Part cannot exist without the whole
Ownership: Container owns and manages the part's lifecycle
UML notation: Filled diamond (◆)

class Heart {
public:
    void beat() { cout << "Heart is beating" << endl; }
};

class Human {
private:
    Heart heart;  // Composition - Heart is created and destroyed with Human

public:
    void live() {
        heart.beat();
    }
};
// When Human object is destroyed, Heart is automatically destroyed

Aggregation (Weak Ownership)

Independent lifecycle: Part can exist independently of the whole
Ownership: Container uses but doesn't own the part
UML notation: Empty diamond (◇)

class Professor {
    string name;
public:
    Professor(string n) : name(n) {}
    string getName() { return name; }
};

class Department {
private:
    vector<Professor*> professors;  // Aggregation - Professors exist independently

public:
    void addProfessor(Professor* p) {
        professors.push_back(p);
    }

    void listProfessors() {
        for (auto p : professors) {
            cout << p->getName() << endl;
        }
    }
};

int main() {
    Professor* john = new Professor("Dr. John");
    Professor* jane = new Professor("Dr. Jane");

    Department csDept;
    csDept.addProfessor(john);
    csDept.addProfessor(jane);

    // Professors can exist even if Department is destroyed
    Department mathDept;
    mathDept.addProfessor(john);  // Same professor in multiple departments

    delete john;
    delete jane;
    return 0;
}

Comparison Table

Aspect	Composition	Aggregation
Ownership	Strong (owns the part)	Weak (uses the part)
Lifecycle	Part dies with whole	Part survives whole
Multiplicity	Part belongs to one whole	Part can belong to many
Example	Human-Heart	Department-Professor
UML Symbol	◆ (filled diamond)	◇ (empty diamond)

4. Key Differences

IS-A vs HAS-A Comparison

Feature	Inheritance (IS-A)	Composition (HAS-A)
Relationship	"is a type of"	"has a" / "uses a"
Purpose	Type hierarchy & polymorphism	Reuse functionality
Coupling	Tight coupling	Loose coupling
Flexibility	Less flexible	Highly flexible
Runtime Changes	Cannot change parent	Can swap components
Testing	Harder to mock	Easy to mock
Code Reuse	Through inheritance	Through delegation
Industry Preference	Use sparingly	Highly preferred

Visual Comparison

INHERITANCE (IS-A)                    COMPOSITION (HAS-A)
==================                    ===================

    Animal                                  Car
      ↑                                    /   \
      |                               Engine   Wheel
    Dog
                                    Car "has" Engine
Dog "is a" Animal                   Car "has" Wheels

5. Design Principles

Golden Rule (Industry Standard)

"Prefer composition over inheritance"
— Gang of Four (Design Patterns Book)

Why Composition is Preferred

Loose Coupling: Components can be changed independently
Flexibility: Behavior can be changed at runtime
Testability: Easy to mock dependencies
Single Responsibility: Each class has one reason to change
Avoids Fragile Base Class: Changes to parent don't break children

When to Use Inheritance

Use inheritance only when:

There is a genuine IS-A relationship
You need runtime polymorphism
The relationship is unlikely to change
Liskov Substitution Principle (LSP) is satisfied

Liskov Substitution Principle (LSP)

Objects of a superclass should be replaceable with objects of subclasses without breaking the application.

// Good Example - LSP satisfied
class Bird {
public:
    virtual void move() { cout << "Bird is moving" << endl; }
};

class Sparrow : public Bird {
public:
    void move() override { cout << "Sparrow is flying" << endl; }
};

class Penguin : public Bird {
public:
    void move() override { cout << "Penguin is swimming" << endl; }
};

// Bad Example - LSP violated
class Bird {
public:
    virtual void fly() { cout << "Bird is flying" << endl; }
};

class Penguin : public Bird {  // Penguin can't fly!
public:
    void fly() override {
        throw runtime_error("Penguins can't fly!");  // Violates LSP
    }
};

6. Real-World Examples

Example 1: E-Commerce System

// Interfaces
class ITaxCalculator {
public:
    virtual double calculateTax(double amount) = 0;
    virtual ~ITaxCalculator() {}
};

class IPaymentProcessor {
public:
    virtual bool processPayment(double amount) = 0;
    virtual ~IPaymentProcessor() {}
};

// Implementations (IS-A relationships)
class IndianTax : public ITaxCalculator {
public:
    double calculateTax(double amount) override {
        return amount * 0.18;  // 18% GST
    }
};

class USTax : public ITaxCalculator {
public:
    double calculateTax(double amount) override {
        return amount * 0.08;  // 8% Sales tax
    }
};

class CreditCardProcessor : public IPaymentProcessor {
public:
    bool processPayment(double amount) override {
        cout << "Processing credit card payment: $" << amount << endl;
        return true;
    }
};

class PayPalProcessor : public IPaymentProcessor {
public:
    bool processPayment(double amount) override {
        cout << "Processing PayPal payment: $" << amount << endl;
        return true;
    }
};

// Order class using HAS-A relationships
class Order {
private:
    ITaxCalculator* taxCalculator;      // HAS-A
    IPaymentProcessor* paymentProcessor; // HAS-A
    double subtotal;

public:
    Order(ITaxCalculator* tax, IPaymentProcessor* payment)
        : taxCalculator(tax), paymentProcessor(payment), subtotal(0) {}

    void addItem(double price) {
        subtotal += price;
    }

    double getTotal() {
        return subtotal + taxCalculator->calculateTax(subtotal);
    }

    bool checkout() {
        double total = getTotal();
        cout << "Subtotal: $" << subtotal << endl;
        cout << "Tax: $" << taxCalculator->calculateTax(subtotal) << endl;
        cout << "Total: $" << total << endl;
        return paymentProcessor->processPayment(total);
    }
};

int main() {
    IndianTax indianTax;
    CreditCardProcessor creditCard;

    Order order(&indianTax, &creditCard);
    order.addItem(100);
    order.addItem(50);
    order.checkout();

    return 0;
}

Relationships:

IndianTax IS-A ITaxCalculator (Inheritance)
CreditCardProcessor IS-A IPaymentProcessor (Inheritance)
Order HAS-A ITaxCalculator (Composition)
Order HAS-A IPaymentProcessor (Composition)

Example 2: Game Character System

// Component interfaces
class IWeapon {
public:
    virtual void attack() = 0;
    virtual int getDamage() = 0;
    virtual ~IWeapon() {}
};

class IArmor {
public:
    virtual int getDefense() = 0;
    virtual ~IArmor() {}
};

// Weapon implementations (IS-A)
class Sword : public IWeapon {
public:
    void attack() override { cout << "Sword slash!" << endl; }
    int getDamage() override { return 25; }
};

class Bow : public IWeapon {
public:
    void attack() override { cout << "Arrow shot!" << endl; }
    int getDamage() override { return 15; }
};

class Staff : public IWeapon {
public:
    void attack() override { cout << "Magic blast!" << endl; }
    int getDamage() override { return 30; }
};

// Armor implementations (IS-A)
class PlateArmor : public IArmor {
public:
    int getDefense() override { return 50; }
};

class LeatherArmor : public IArmor {
public:
    int getDefense() override { return 20; }
};

// Character base class
class Character {
protected:
    string name;
    int health;
    IWeapon* weapon;  // HAS-A
    IArmor* armor;    // HAS-A

public:
    Character(string n, int h) : name(n), health(h), weapon(nullptr), armor(nullptr) {}

    void equip(IWeapon* w) { weapon = w; }
    void equip(IArmor* a) { armor = a; }

    virtual void attack() {
        if (weapon) {
            cout << name << " attacks! ";
            weapon->attack();
        }
    }

    void showStats() {
        cout << "=== " << name << " ===" << endl;
        cout << "Health: " << health << endl;
        cout << "Damage: " << (weapon ? weapon->getDamage() : 0) << endl;
        cout << "Defense: " << (armor ? armor->getDefense() : 0) << endl;
    }

    virtual ~Character() {}
};

// Character types (IS-A)
class Warrior : public Character {
public:
    Warrior(string n) : Character(n, 150) {}

    void rage() {
        cout << name << " enters rage mode!" << endl;
    }
};

class Mage : public Character {
public:
    Mage(string n) : Character(n, 80) {}

    void castSpell() {
        cout << name << " casts a powerful spell!" << endl;
    }
};

int main() {
    // Create weapons and armor
    Sword sword;
    Staff staff;
    PlateArmor plate;
    LeatherArmor leather;

    // Create characters
    Warrior thor("Thor");
    Mage gandalf("Gandalf");

    // Equip characters (composition at work)
    thor.equip(&sword);
    thor.equip(&plate);

    gandalf.equip(&staff);
    gandalf.equip(&leather);

    // Show stats
    thor.showStats();
    cout << endl;
    gandalf.showStats();

    cout << endl;
    thor.attack();
    gandalf.attack();

    return 0;
}

Example 3: Logger System

#include <fstream>
#include <ctime>

// Logger interface
class ILogger {
public:
    virtual void log(string message) = 0;
    virtual ~ILogger() {}
};

// Logger implementations (IS-A)
class ConsoleLogger : public ILogger {
public:
    void log(string message) override {
        cout << "[CONSOLE] " << message << endl;
    }
};

class FileLogger : public ILogger {
    string filename;
public:
    FileLogger(string file) : filename(file) {}

    void log(string message) override {
        ofstream file(filename, ios::app);
        file << "[FILE] " << message << endl;
        file.close();
    }
};

// Application using composition
class Application {
private:
    string name;
    ILogger* logger;  // HAS-A relationship

public:
    Application(string n, ILogger* l) : name(n), logger(l) {}

    void run() {
        logger->log(name + " started");
        // Application logic here...
        logger->log(name + " completed successfully");
    }

    void setLogger(ILogger* l) {
        logger = l;  // Can swap logger at runtime!
    }
};

int main() {
    ConsoleLogger consoleLog;
    FileLogger fileLog("app.log");

    Application app("MyApp", &consoleLog);
    app.run();

    // Switch to file logger at runtime
    app.setLogger(&fileLog);
    app.run();

    return 0;
}

7. Common Mistakes

Mistake 1: Using Inheritance for Code Reuse Only

// WRONG - Using inheritance just for code reuse
class ArrayList {
public:
    void add(int item) { /* ... */ }
    int get(int index) { /* ... */ }
};

class Stack : public ArrayList {  // Stack is NOT an ArrayList!
public:
    void push(int item) { add(item); }
    int pop() { /* ... */ }
};

// Problem: Stack now exposes get(index) which breaks stack semantics

// CORRECT - Using composition
class ArrayList {
public:
    void add(int item) { /* ... */ }
    int get(int index) { /* ... */ }
    int removeLast() { /* ... */ }
};

class Stack {
private:
    ArrayList list;  // HAS-A relationship

public:
    void push(int item) { list.add(item); }
    int pop() { return list.removeLast(); }
    // get(index) is NOT exposed - proper encapsulation
};

Mistake 2: Deep Inheritance Hierarchies

// WRONG - Too deep hierarchy
class Animal { };
class Mammal : public Animal { };
class Carnivore : public Mammal { };
class Feline : public Carnivore { };
class Cat : public Feline { };
class DomesticCat : public Cat { };
class PersianCat : public DomesticCat { };  // 7 levels deep!

// BETTER - Flatten with composition
class Animal {
    DietType diet;           // HAS-A
    ReproductionType repro;  // HAS-A
    BehaviorSet behaviors;   // HAS-A
};

class Cat : public Animal {
    BreedInfo breed;  // HAS-A
};

Mistake 3: Violating Liskov Substitution Principle

// WRONG - Square is not a proper Rectangle
class Rectangle {
protected:
    int width, height;
public:
    virtual void setWidth(int w) { width = w; }
    virtual void setHeight(int h) { height = h; }
    int getArea() { return width * height; }
};

class Square : public Rectangle {
public:
    void setWidth(int w) override {
        width = w;
        height = w;  // Forces both to be equal
    }
    void setHeight(int h) override {
        width = h;
        height = h;  // Forces both to be equal
    }
};

// This breaks!
void resize(Rectangle& r) {
    r.setWidth(5);
    r.setHeight(10);
    assert(r.getArea() == 50);  // Fails for Square!
}

8. Interview Questions

Q1: What is the difference between IS-A and HAS-A relationships?

Answer:

IS-A (Inheritance): Represents a "type of" relationship where a child class derives from a parent class. Example: Dog IS-A Animal.
HAS-A (Composition): Represents a "contains" relationship where one class has another class as a member. Example: Car HAS-A Engine.

Q2: Why is composition preferred over inheritance?

Answer:
Composition is preferred because:

Loose coupling: Components can be changed independently
Flexibility: Behavior can be changed at runtime
Better encapsulation: Internal details are hidden
Easier testing: Dependencies can be easily mocked
Avoids fragile base class problem: Parent changes don't break children

Q3: Can we use both inheritance and composition together?

Answer:
Yes, and this is the recommended approach in real systems:

Use inheritance for genuine type hierarchies and polymorphism
Use composition for combining behaviors and functionality

Example: IndianTax IS-A TaxCalculator (inheritance) + Invoice HAS-A TaxCalculator (composition)

Q4: What is the difference between Composition and Aggregation?

Answer:
| Aspect | Composition | Aggregation |
|--------|-------------|-------------|
| Ownership | Strong - parent owns child | Weak - parent uses child |
| Lifecycle | Child dies with parent | Child survives parent |
| Example | Human-Heart | Team-Player |

Q5: When should you use inheritance?

Answer:
Use inheritance when:

There is a genuine IS-A relationship
Liskov Substitution Principle is satisfied
You need runtime polymorphism
The relationship is stable and unlikely to change

Q6: What is the Diamond Problem? How do you solve it?

Answer:
The diamond problem occurs in multiple inheritance when a class inherits from two classes that have a common ancestor.

class A { public: void show() { } };
class B : public A { };
class C : public A { };
class D : public B, public C { };  // Diamond problem - which A::show()?

Solution: Use virtual inheritance

class A { public: void show() { } };
class B : virtual public A { };
class C : virtual public A { };
class D : public B, public C { };  // Only one copy of A

Q7: How do you decide between IS-A and HAS-A?

Answer:
Use this decision framework:

Sentence Test:
- If "X is a Y" makes sense → Inheritance
- If "X has a Y" makes sense → Composition
Behavior Test:
- Can child substitute parent everywhere? → Inheritance
- Does class need to use another class's features? → Composition
Change Test:
- Is the relationship permanent? → Inheritance
- Might the relationship change? → Composition

Quick Decision Flowchart

                    Start
                      |
                      v
        Does "X is a Y" make sense?
                    /    \
                 Yes      No
                  |        |
                  v        v
         Can X substitute      Does X need
         Y everywhere?         Y's features?
              /  \                /    \
           Yes    No           Yes     No
            |      |            |       |
            v      v            v       v
      Inheritance  Composition  Composition  No relationship

Self-Test Exercises

Determine the correct relationship for each:

Statement	Your Answer	Correct Answer
Dog and Animal		Inheritance
Car and Engine		Composition
Manager and Employee		Inheritance
Order and Payment		Composition
Circle and Shape		Inheritance
University and Department		Composition
SavingsAccount and BankAccount		Inheritance
Computer and CPU		Composition
Penguin and Bird		Inheritance
Library and Book		Aggregation

Summary

Concept	Key Point
IS-A (Inheritance)	Child is a specialized type of parent
HAS-A (Composition)	Class contains/uses another class
Composition	Strong ownership, part dies with whole
Aggregation	Weak ownership, part survives whole
Golden Rule	Prefer composition over inheritance
Use Inheritance When	True IS-A + LSP satisfied + Need polymorphism
Use Composition When	Need flexibility + Loose coupling + Runtime changes

Remember:

Inheritance = IS-A relationship
Composition = HAS-A relationship
Use composition by default
Use inheritance only when logically required and LSP is satisfied

Understanding Reciprocal Rank Fusion (RRF) in Retrieval-Augmented Systems

Rajat Sharma — Sat, 26 Apr 2025 18:20:19 +0000

In our last discussion, we explored how Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by fetching external information to improve their responses.

Today, let's dive deeper into a key retrieval technique used inside RAG systems: Reciprocal Rank Fusion (RRF).

✨ What is Reciprocal Rank Fusion (RRF)?

Reciprocal Rank Fusion is a simple yet powerful algorithm used to combine search results from multiple queries.

Instead of depending on just a single query to retrieve documents, RRF:

Fans out multiple subqueries
Retrieves results separately for each
Merges them so that higher-ranked results are prioritized across the different searches

🔥 In short: RRF combines multiple search results intelligently so that the most relevant documents rise to the top.

🤔 Why Use RRF?

Sometimes a single query can't capture everything the user needs.

For example, if a user asks:

"What are the challenges of task decomposition?"

Depending on how it's phrased, you might miss out on some valuable documents!

✅ By generating multiple sub-questions,

✅ Retrieving documents for each sub-question, and

✅ Merging the results using RRF,

—you ensure broader coverage without losing precision.

🛠 How Does RRF Work?

Let's break it down step-by-step:

Stage	What Happens
Subquery Generation	Create multiple focused sub-questions based on the main query.
Parallel Retrieval	Retrieve relevant documents separately for each sub-question.
Reciprocal Rank Fusion	Merge documents intelligently based on their ranks (using the RRF formula).
Final Selection	Select top-scoring documents for context or generation.

🧮 The RRF Formula

Each document's RRF score is computed as:

RRF_score = ∑ (1 / (k + rank))

rank = Position of the document in the retrieval list (starting from 0)
k = A small constant (commonly 60) that dampens the impact of lower-ranked documents.

⚡ Thus, documents that consistently rank higher across different queries will be scored higher and surfaced earlier!

🔥 Flowchart for Visual Understanding

🧩 Simple Code Snippet for Learning

Here’s a mini Python function showing how RRF merging happens:

def reciprocal_rank_fusion(subquestions, k=60):
    all_ranked_results = []

    # Retrieve chunks for each sub-question
    for subq in subquestions:
        chunks = retrieve_chunks(subq["question"])
        all_ranked_results.append(chunks)

    score_dict = {}

    # Apply RRF scoring
    for chunks in all_ranked_results:
        for rank, doc in enumerate(chunks):
            key = (doc.metadata.get("page"), doc.page_content.strip())
            if key not in score_dict:
                score_dict[key] = {"doc": doc, "score": 0}
            score_dict[key]["score"] += 1 / (k + rank)

    # Sort by score
    fused_docs = sorted(score_dict.values(), key=lambda x: x["score"], reverse=True)

    return [entry["doc"] for entry in fused_docs]

📌 Highlights:

Retrievals happen in parallel for each subquery.

Rank and reciprocal scores intelligently merge the results.

Final documents are sorted and fused based on their scores.

🎯 Conclusion

Reciprocal Rank Fusion (RRF) is a powerful technique that broadens context intelligently without introducing too much irrelevant information.

It ensures:

Broader and more accurate retrieval
Preference for high-quality, semantically rich documents
Better context for LLMs to generate superior outputs

🌟 What's Next?

Stay tuned!

In future articles, we'll cover more advanced retrieval techniques like:

🔹 Step-Back Prompting
🔹 Chain-of-Thought Retrieval
🔹 Hybrid Search
🔹 Hierarchical Decomposition (HyDE)

🚀 Stay Curious. Keep Building!

Are you curious about how Retrieval-Augmented Generation (RAG) actually works? Dive into this overview to gain a deeper understanding of the concept and its applications. This is Chapter 1, with more detailed insights coming soon. Stay tuned for further

Rajat Sharma — Sun, 20 Apr 2025 09:01:20 +0000

Rajat Sharma

Apr 20 '25

An Introduction to Retrieval-Augmented Generation

#rag #webdev #programming #ai

Comments

2 min read

An Introduction to Retrieval-Augmented Generation

Rajat Sharma — Sun, 20 Apr 2025 08:44:28 +0000

Chapter1 - Introduction to Retrieval-Augmented Generation (RAG)

Overview

Retrieval-Augmented Generation (RAG) is an AI framework that enhances the capabilities of Large Language Models (LLMs) by retrieving relevant information from external data sources and feeding this information as context into the language model to generate more accurate, informative, and contextually relevant responses.

In this post, we'll break down the basic components of RAG, how it works, and give you a visual understanding of the process.

What is RAG?
How does RAG work?
Summary Table
Flow Chart for Visual Understanding
Conclusion

What is RAG?

RAG is an AI framework that optimizes LLMs by integrating external data to enhance response accuracy and informativeness. When combined with a retrieval mechanism, the model can answer user queries with more depth and relevance by pulling context from a vast set of external data sources.

How does RAG work?

1. Indexing:

This process prepares external data for retrieval. Key steps include:

Data Collection: Gathering the necessary data for your application.
Data Chunking: Breaking large datasets into smaller, manageable chunks.
Document Embedding: Converting text chunks into vectors that capture semantic meaning.
Vector Storing: Storing these vectors in a vector database (like Pinecone, Qdrant, or Weaviate) for efficient searching.

2. Retrieval:

Query Embedding: Converting the user’s query into a vector using the same model as the document embeddings.
Similarity Search: Comparing the query vector with stored document vectors to retrieve the most relevant chunks.
Top-k Retrieval: Identifying and returning the top matching chunks from the vector database.

3. Generation:

Once relevant chunks are retrieved, they are fed into the LLM along with the user's query to generate the final response.

Input to LLM: The context (user query + retrieved text chunks) is provided to the LLM.
Contextual Understanding: The LLM processes the provided information and understands the user’s intent.
Response Generation: The LLM synthesizes a coherent and informative response.

Summary Table

Stage	What Happens
Indexing	Collect → Chunk → Embed → Store in vector DB
Retrieval	Embed query → Search vector DB → Return top-matching chunks
Generation	Combine query + retrieved context → Feed into LLM → Generate final response

Flow Chart for Visual Understanding

Conclusion

In this post, we’ve covered the fundamentals of Retrieval-Augmented Generation (RAG). The process includes:

Indexing: Preparing the data.
Retrieval: Fetching relevant chunks based on the user query.
Generation: Combining the retrieved data with the user’s query for a coherent response.

In future posts, we’ll dive deeper into advanced RAG concepts, such as step-back prompting, RRF (Relevance Feedback), parallel query retrieval, CoT (Chain of Thought), and HyDE (Hybrid Dense Encoding).

Stay tuned for more informative blogs!

🚀 How AI Thinks - From Meaning to Magic

Rajat Sharma — Wed, 09 Apr 2025 10:29:05 +0000

Perfect — let’s now take everything we’ve learned so far and add the “How AI interprets it” layer.

You still won’t need to know code.

Instead, I’ll show you:

What each concept means (as before)
How AI internally uses it to do smart things (like predict, translate, or generate text)
How all these concepts connect in a step-by-step “how AI works” explanation

Let’s go deeper — still friendly, still beginner-safe, but now revealing the AI's brain behind the scenes.

🧠 How AI Thinks — From Meaning to Magic

🌍 1. Vectors — How AI Understands Ideas

🧠 Think of a vector like a recipe of meaning.

When you say a word like “happy”, AI doesn’t see letters.

It turns it into a set of numbers — like:

[0.8, 0.3, 0.1, ..., 0.6] (maybe 768 or 1024 numbers long!)

Each number captures something — maybe emotion, tone, type of word, or context.

So:

“Happy” and “Joyful” might have very similar vectors.
“Happy” and “Angry” would have very different ones.

🔍 Why this matters:

This is how AI understands similarity.

If you search “joyful songs,” it knows to include “happy songs” too.

🗺️ 2. Embeddings — Where Meaning Lives

🎯 An embedding is the process of placing words into the “meaning space.”

Once you turn a word into a vector, you’re placing it somewhere in a huge “idea map”.

Think:

“Doctor”, “Nurse”, “Hospital” all live near each other.
“Moon” and “Ocean” might be connected by “tide”.

🌐 AI uses this to:

Group similar words together
Guess what word might come next
Understand themes, even if words aren’t exact

📍 3. Positional Encoding — Remembering Word Order

🧩 Without word order, “You ate the cake” is the same as “The cake ate you.”

AI looks at everything as tokens or vectors. But it needs help knowing which word came first.

So it adds position signals like:

“This is the 1st word, this is the 2nd, etc.”

It’s like putting a sticky note on each word: “I came first!”

Now AI doesn’t just know the words — it knows their sequence, too.

👀 4. Self-Attention — AI Reading Its Own Thoughts

“The cat drank water because it was thirsty.”

What was thirsty?

AI doesn't assume — it uses self-attention.

Here’s how it works:

It looks at “it”
Then scans the whole sentence to see what “it” could mean
Gives higher “attention weight” to “cat” than “water”

So internally, AI says:

“I think ‘it’ probably means ‘cat’ based on context.”

🧠 That’s how it keeps meaning intact over long texts.

🧠 5. Multi-Head Attention — Different Lenses, Same Sentence

Reading a message, you might notice emotion, grammar, or names separately.

AI does the same — with multiple attention heads.

Each “head” looks at something different:

Head 1: Emotional tone
Head 2: Relationships between words
Head 3: Verb tenses
…and more

Then it combines them to understand the full picture.

🎛️ 6. Softmax — Choosing the Next Word

After all that understanding… how does AI decide what to say?

Let’s say the AI is trying to finish the sentence:

“The sky is…”

It might think:

“blue” (80% sure)
“dark” (15%)
“cloudy” (5%)

Softmax turns those guesses into weighted choices, and picks one.

So it’ll likely choose “blue”, but could still surprise you.

🔥 7. Temperature — Controlling Creativity

You can tell AI how safe or wild to be.

Low temperature (0.2) = serious, factual, boring
High temperature (1.0+) = funny, poetic, random

So:

Prompt: “Write a poem about dogs”
Low temp: “Dogs are loyal, kind, and sweet”
High temp: “Dogs are fuzzy comets chasing barkstars in space”

✂️ 8. Tokenization — Breaking Down Language

AI doesn’t read sentences like humans. It breaks everything into pieces.

Example: “Unbelievable” becomes:

“Un” + “believe” + “able”

Why?

AI can then mix and match parts of words
It can handle new words by understanding smaller pieces

This also keeps the vocabulary size manageable.

📚 9. Vocab Size — What Words AI Knows

Every AI model has a limit — like a backpack of words.

A small model might know 5,000 pieces (tokens)
ChatGPT might know 50,000 or more

If a word is outside its vocab? It breaks it down, or might not know it well.

📅 10. Knowledge Cutoff — The AI’s “Last School Year”

AI was trained on data until a certain date (like April 2023).

After that, it doesn’t know what happened unless you tell it.

So:

“Who won the 2024 Oscars?”

AI might say: “I don’t know, I wasn’t trained on that.”

That’s the knowledge cutoff.

🧠 How It All Comes Together — A Simple Mental Model

Let’s say you ask AI:

“Write me a story about a panda who becomes a chef.”

Here’s how it works (simplified):

Tokenize your message into small pieces
Embed each piece into a vector (idea numbers)
Add positional encoding to keep word order
Run through transformer layers
- Use self-attention and multi-head attention to understand what’s important
Use softmax to guess the next best word
Adjust with temperature (creativity level)
Repeat until your story is done
Convert tokens back to readable text

And BOOM—you get:

“Once upon a time, in a bamboo forest, lived a panda named Pabu who loved soup…”

💬 Final Words

Every concept we just explained is a piece of how AI thinks.

You don’t need to memorize anything — just keep this in mind:

AI is not magic. It’s math + meaning + memory + creativity — mixed together to feel human.

🚀 Debouncing in JavaScript & React — Make Your App Smoother!

Rajat Sharma — Sat, 29 Mar 2025 18:34:09 +0000

👋 Hey folks! I'm Rajat Sharma, and today we’re diving into an underrated but powerful concept: Debouncing.

Have you ever typed in a search bar and noticed how some apps wait a moment before responding?

That’s not lag — it’s debouncing, and it’s intentional.

In this article, you'll learn:

What debouncing is
Why it matters in modern web apps
How to implement it in React (with real API examples!)
And the trade-off it brings

Let’s go! 🧠✨

🧩 What is Debouncing?

Debouncing is a technique used to delay the execution of a function until a certain time has passed since it was last called.

This is super useful for:

Typing in input fields
Window resizing
Rapid clicking

Without debouncing, each keystroke can fire an API call. That’s a lot of unnecessary traffic! 😱

🧪 Real-Life Use Case

You're building a postal code search.

User types 800001 — should we fire six API calls? NO!

Instead, wait a little after the last keystroke → only fire one request. ✅

🧰 Basic Setup (Without Debounce)

import axios from "axios";
import React from "react";

export default function App() {
  const setInput = (value) => {
    axios.get(`https://api.postalpincode.in/pincode/${value}`)
      .then((res) => {
        console.log(res.data[0]?.PostOffice[0]);
      });
  };

  return (
    <div>
      <input
        placeholder="Enter Pincode..."
        onChange={(e) => setInput(e.target.value)}
      />
    </div>
  );
}

❌ Problem: Every keypress hits the API. Not efficient.

✅ Debouncing with `setTimeout` + `useEffect`

Let’s optimize it!

1️⃣ Add state

const [pinCode, setPinCode] = React.useState("");

2️⃣ Update input on change

<input
  placeholder="Enter Pincode..."
  onChange={(e) => setPinCode(e.target.value)}
/>

3️⃣ Debounce API call in `useEffect`

React.useEffect(() => {
  const timer = setTimeout(() => {
    if (pinCode) {
      axios.get(`https://api.postalpincode.in/pincode/${pinCode}`)
        .then((res) => {
          console.log(res.data[0]);
        });
    }
  }, 2000); // 2 second debounce

  return () => clearTimeout(timer);
}, [pinCode]);

✅ Now the API call triggers only after user stops typing for 2 seconds.

🧩 Full Working Code

import axios from "axios";
import React from "react";

export default function App() {
  const [pinCode, setPinCode] = React.useState("");

  React.useEffect(() => {
    const timer = setTimeout(() => {
      if (pinCode) {
        axios
          .get(`https://api.postalpincode.in/pincode/${pinCode}`)
          .then((res) => {
            console.log(res.data[0]);
          });
      }
    }, 2000);

    return () => clearTimeout(timer);
  }, [pinCode]);

  return (
    <div>
      <input
        placeholder="Enter Pincode..."
        onChange={(e) => setPinCode(e.target.value)}
      />
    </div>
  );
}

🎉 Now typing 800001 triggers just one API call!

🎯 Where Else Can You Use Debouncing?

🔍 Search Bars
📝 Form Auto-save
🪟 Resize Listeners
🖱️ Button Clicks

🔧 Bonus: Use `lodash.debounce` for Cleaner Code

Install it:

npm install lodash.debounce

Use it:

import debounce from "lodash.debounce";

const debouncedFetch = debounce((value) => {
  axios.get(`https://api.postalpincode.in/pincode/${value}`).then(...);
}, 2000);

This makes your code reusable and cleaner!

⚖️ Is Debouncing Making Your App Feel Slow?

That's a good observation! Here's the deal:

✅ Pros:

Prevents API spamming
Smooths out performance
Saves server resources

⚠️ Cons:

Adds a perceived delay to the response
Not ideal when users expect instant feedback

🧠 My Take:

If your use case involves:

Heavy API calls
User typing/searching → Use shorter debounce delays (e.g., 300-500ms)

Use 2000ms only when response is non-urgent or API is expensive.

🧠 Final Thoughts

Debouncing is a must-know for every developer.

It helps create apps that are efficient, responsive, and smooth.

So next time your UI lags behind your API — debounce it, don’t spam it!

🙌 Stay Connected

If this helped you out, drop a 💬 or ❤️ below!

🧑‍💻 Happy Coding!

Let me know — I’d love to help you make this article shine even more!

Understanding Sessions and Tokens: A Deep Dive

Rajat Sharma — Wed, 19 Mar 2025 09:13:42 +0000

When building modern web applications, managing authentication is one of the most crucial aspects. Two major approaches are used for authentication:

Session-based authentication
Token-based authentication

In this article, we’ll explore these concepts in detail and understand how they relate to Local Storage, Access Tokens, and Refresh Tokens.

🔑 What is a Session?

A session is a way to maintain user authentication by storing session data on the server. When a user logs in, the server creates a session and assigns it a unique Session ID. This ID is stored in a cookie and sent with each request, allowing the server to recognize the user.

🛠 How Session-based Authentication Works

User logs in → Credentials (username & password) are sent to the server.
Server validates → If correct, the server creates a session and generates a Session ID.
Session storage → The Session ID is stored in a cookie (HttpOnly & Secure recommended).
Requests include the session → Every request contains the session ID, allowing the server to authenticate the user.
Session expiration → The session expires after a set time or when the user logs out.

🚨 Drawbacks of Session-based Authentication

Requires server-side storage, leading to scalability issues.
Works best for monolithic applications but is not ideal for microservices or APIs.
Can be vulnerable to Session Hijacking if cookies are not properly secured.

🔑 What is a Token?

A token is a self-contained, stateless authentication mechanism that allows authentication without requiring server-side session storage.

The most common format is JWT (JSON Web Token), which contains encoded user information, expiration time, and a signature for verification.

🛠 How Token-based Authentication Works

User logs in → Credentials are sent to the server.
Server validates → If correct, the server generates a JWT (Access Token) and returns it to the client.
Client stores the token → The token is stored in Local Storage, Session Storage, or HTTP-only Cookies.
Requests include the token → The client includes the token in the Authorization header (Bearer <token>).
Server validates the token → The server verifies the token’s signature and extracts the user information.
Token expiration → Once expired, a Refresh Token is used to get a new Access Token.

✅ Advantages of Token-based Authentication

Stateless → No need to store sessions on the server, making it scalable.
Secure → Can be signed & encrypted.
Ideal for APIs → Works well with SPAs (React, Vue, Angular) and microservices.

📌 Access Token vs. Refresh Token

🔹 Access Token

Short-lived (e.g., 15 minutes to 1 hour).
Sent with every request in the Authorization header.
Used to authenticate users in APIs.

🔹 Refresh Token

Long-lived (e.g., 7 days to 30 days).
Stored securely (e.g., HTTP-only Cookies).
Used to obtain a new Access Token without re-authenticating.

🛠 How Refresh Tokens Work

The Access Token expires after a short time.
The client sends a Refresh Token to the server.
The server validates the Refresh Token.
If valid, a new Access Token is issued.
If expired or invalid, the user must log in again.

📂 Where to Store Tokens?

1️⃣ Local Storage (`window.localStorage`)

✅ Pros:

Persistent (survives page reloads).
Easy to use.

❌ Cons:

Vulnerable to XSS attacks.
Cannot be accessed by HttpOnly flags.

2️⃣ Session Storage (`window.sessionStorage`)

✅ Pros:

Accessible only within the session.
Clears when the tab is closed.

❌ Cons:

Vulnerable to XSS attacks.
Does not persist across sessions.

3️⃣ HTTP-only Cookies (`Set-Cookie` header)

✅ Pros:

Not accessible by JavaScript (protected from XSS).
Automatically included in every request.

❌ Cons:

Vulnerable to CSRF attacks if not properly secured.
Requires additional security measures like SameSite, Secure, HttpOnly flags.

🆚 Session vs. Token Authentication

Feature	Session-based Authentication	Token-based Authentication
Storage	Server-side	Client-side (JWT, Tokens)
Scalability	Less scalable	Highly scalable
Security Risks	Session Hijacking	XSS, CSRF attacks
Best for	Monolithic apps	SPAs, Mobile, APIs

🔐 Best Practices for Secure Authentication

Use HTTP-only cookies for storing Refresh Tokens.
Set expiration time on Access Tokens and Refresh Tokens.
Implement CSRF protection when using cookies.
Use HTTPS to prevent token interception.
Validate JWTs properly on the server.
Blacklist compromised tokens when logging out.

🎯 Final Thoughts

Both sessions and tokens have their pros and cons. While session-based authentication is useful for traditional web applications, token-based authentication is better suited for modern SPAs and APIs. Refresh Tokens provide a way to keep users logged in without exposing security risks.

If you're building an authentication system, understanding these differences will help you choose the right approach based on your needs.

🚀 Have questions or thoughts? Drop a comment below!

Understanding Access Tokens and Refresh Tokens in Authentication

Rajat Sharma — Fri, 21 Feb 2025 11:33:55 +0000

Access Tokens and Refresh Tokens in Authentication

Authentication is a crucial aspect of web applications, ensuring that users can securely access resources and perform actions. In modern web applications, Access Tokens and Refresh Tokens play a vital role in managing authentication. This article will cover what they are, how they work, and their role in secure authentication.

What Are Access Tokens and Refresh Tokens?

Access Token

An Access Token is a short-lived token used to access protected resources. It is included in API requests to authenticate the user.

Typically, an access token is a JWT (JSON Web Token).
It contains user-related data such as user ID, role, and expiration time.
Stored client-side, usually in memory or local storage.
Valid for a short period (e.g., 15 minutes to 1 hour).
Once expired, it cannot be used to make API requests.

Refresh Token

A Refresh Token is a long-lived token used to obtain a new access token without requiring the user to log in again.

It is issued alongside the access token when the user logs in.
It is stored securely (HTTP-only cookie or database).
Used when the access token expires to obtain a new access token.
Has a longer expiration time (e.g., 7 days or more).
Prevents the need for frequent re-authentication.

How Access Token and Refresh Token Work

The authentication flow typically follows these steps:

User logs in using their credentials.
The server validates the credentials and issues:
- An Access Token (short-lived, used for API requests).
- A Refresh Token (long-lived, used to get new access tokens).
The Access Token is included in API requests (e.g., via Authorization: Bearer <token> header).
When the Access Token expires, the client sends the Refresh Token to the server to get a new Access Token.
The server verifies the Refresh Token, issues a new Access Token, and updates the Refresh Token if necessary.
If the Refresh Token is invalid or expired, the user is required to log in again.

Generating Access and Refresh Tokens in Node.js

In a Node.js backend (e.g., Express.js), you can generate JWTs using the jsonwebtoken package.

Install JSON Web Token (JWT) package:

npm install jsonwebtoken

Generate Access and Refresh Tokens:

import jwt from "jsonwebtoken";

const generateTokens = (userId) => {
  const accessToken = jwt.sign(
    { _id: userId },
    process.env.ACCESS_TOKEN_SECRET,
    { expiresIn: "15m" }
  );

  const refreshToken = jwt.sign(
    { _id: userId },
    process.env.REFRESH_TOKEN_SECRET,
    { expiresIn: "7d" }
  );

  return { accessToken, refreshToken };
};

Storing Tokens Securely

Access Token: Store in memory or secure HTTP headers (avoid local storage to prevent XSS attacks).
Refresh Token: Store in HTTP-only, secure cookies or databases to prevent theft.

Refreshing Access Token API

const refreshAccessToken = async (req, res) => {
  const incomingRefreshToken = req.cookies.refreshToken;
  if (!incomingRefreshToken) {
    return res.status(401).json({ message: "Unauthorized request" });
  }

  try {
    const decoded = jwt.verify(incomingRefreshToken, process.env.REFRESH_TOKEN_SECRET);
    const newAccessToken = jwt.sign(
      { _id: decoded._id },
      process.env.ACCESS_TOKEN_SECRET,
      { expiresIn: "15m" }
    );

    res.json({ accessToken: newAccessToken });
  } catch (error) {
    res.status(403).json({ message: "Invalid refresh token" });
  }
};

Access Token vs. Session Authentication

Feature	Access Token + Refresh Token	Session Authentication
Stateless	✅ Yes	❌ No (Stored in DB)
Secure from XSS	✅ Yes (if HTTP-only)	❌ No (If stored in local storage)
Scaling	✅ Easy	❌ Hard (Session storage needed)
Performance	✅ Fast	❌ Can slow down with DB lookups
Token Expiry	✅ Yes	❌ No (Session persists)

Conclusion

Access Tokens and Refresh Tokens provide a scalable and secure way to manage authentication in web applications. By using them properly, you can ensure seamless user experiences while maintaining security best practices.

💡 If you found this article helpful, feel free to share your thoughts in the comments below! 🚀

Understanding CORS and Proxies in Web Development: A Simple Analogy

Rajat Sharma — Tue, 04 Feb 2025 10:30:28 +0000

Introduction

In web development, one common challenge developers face is the dreaded CORS error. If you’ve ever worked with APIs, you might have encountered this frustrating issue when trying to fetch data from a different domain. But why does this happen, and how can we fix it? In this article, we’ll dive into the concept of CORS (Cross-Origin Resource Sharing) and Proxies with a simple analogy to make it easy to understand, even for beginners!

What Is CORS?

Before we dive into proxies, let's first understand what CORS is and why it exists.

Imagine you're sending a letter (a request) to your friend’s house (the backend server) located in another city. You live in a different city (the frontend server), and the postal service (the browser) checks where the letter is coming from and whether it’s allowed to be delivered.

If the postal service (the browser) sees that the letter is coming from a different city (a different origin), it might stop the letter from reaching your friend because it’s not trusted.

CORS is like this “security measure” that ensures requests from different domains are safe. Without it, malicious websites could make requests to other servers and steal sensitive data.

Key Points:

CORS is a security mechanism that restricts how resources on a web page can be requested from another domain.
Cross-Origin refers to when the request is being made to a different origin (different domain, protocol, or port).

Why Does CORS Happen?

Without a Proxy: The Letter Analogy

Let’s say your web app (the frontend) is running on http://localhost:3000, and the backend API is running on http://localhost:2000. The frontend sends a request directly to the backend API, but the postal service (the browser) sees this as a request coming from different cities. This is considered cross-origin.

Since CORS is enforced by the browser, the postal service (browser) checks if the backend API allows the request from localhost:3000. If the backend doesn’t send the correct permissions (CORS headers), the browser blocks the request and throws a CORS error.

Here’s the flow:

Frontend: http://localhost:3000 sends a request.
Backend: http://localhost:2000 receives the request but doesn't send the CORS headers.
Browser: Blocks the request due to lack of CORS headers.

The Role of Proxies: How They Solve CORS Issues

Now, let’s introduce the concept of a proxy using the same analogy.

With a Proxy: The Trusted Mail Service

Instead of sending your letter (request) directly from your house (frontend) to your friend’s house (backend), you send it to a trusted mail service that operates from the same city (same domain). This mail service (the proxy server) forwards the letter to your friend (the backend API) on your behalf.

Since the mail service is trusted (it’s from the same city as you), the postal service (the browser) doesn’t block it. The response comes back through the same mail service, and everything seems to have been sent within your own city, even though it actually passed through the proxy.

In technical terms:

Frontend: Sends a request to http://localhost:3000/api/youtube (same origin).
Development Server (Proxy): The proxy forwards the request to http://localhost:2000/api/youtube.
Backend: The backend receives the request from the proxy and responds with the data.
Browser: Sees the request as coming from localhost:3000 (no cross-origin request), so no CORS error occurs.

Why Proxies Are Used in Development

The proxy server is usually used during development to bypass CORS restrictions because it helps:

Avoid CORS issues by making the request appear to be from the same origin.
Improve security by hiding the real API endpoint.
Simplify local development without needing to modify the backend.

Note: This setup is only for development. In production, you have to configure the backend server to handle CORS properly, as proxies are typically not used in production environments.

Comparing Without Proxy vs. With Proxy

Without Proxy	With Proxy
Browser sends a request directly to `http://localhost:2000`	Browser sends a request to `http://localhost:3000/api/youtube`
CORS issue arises due to the cross-origin request	The proxy forwards the request internally to `http://localhost:2000`
The backend API must handle CORS headers	No need for CORS headers in the frontend, as the browser treats it as same-origin
Browser blocks the request due to missing CORS headers	Browser doesn’t block the request since it’s technically same-origin

Conclusion

In summary:

CORS is a security mechanism that prevents unauthorized cross-origin requests.
During development, a proxy helps you bypass CORS issues by forwarding requests to the backend without triggering cross-origin checks in the browser.
In production, you’ll need to configure your backend to handle CORS properly, as proxies are generally only used in development environments.

By using the proxy setup in development, you can focus on building your application without worrying about CORS, allowing smooth communication between your frontend and backend during testing and development.

Call to Action

Have you faced CORS issues while working on your frontend? How did you solve them? Let me know your thoughts or any questions you have about proxies in the comments below!

🌐Introducing HiddenThreads: A Platform for Anonymous Voices

Rajat Sharma — Tue, 28 Jan 2025 17:41:33 +0000

Hey Devs! 👋

I’m thrilled to share my latest project with you all—HiddenThreads, a space where users can anonymously express their thoughts, ideas, and what’s going on in their world. 💬

What is HiddenThreads?

HiddenThreads is designed to be a platform for open interaction. Whether it’s sharing personal stories, thoughts about global events, or just venting anonymously, HiddenThreads gives everyone a voice without judgment.

🌟 Key Features:

Anonymity: No names, no profiles—just raw, unfiltered thoughts.
Interactive Threads: Users can reply and engage with others' messages anonymously.
Safe Space: Moderation ensures the platform remains respectful and welcoming.

Why HiddenThreads?

In a world where social media often ties posts to our identity, I wanted to create a space where people could share freely, without fear of judgment or consequences. HiddenThreads is about honest conversations and genuine interactions.

How You Can Use It

Post your thoughts: Got something on your mind? Share it!
Engage with others: See what others are thinking and start a thread of conversation.
Be inspired: HiddenThreads is also a great place to find inspiration from diverse perspectives.

👉 Check it out now: https://hidden-threads.vercel.app

Feedback Welcome!

This is just the beginning, and I’d love to hear your thoughts.

What features would you like to see? How can this platform evolve to become even more impactful?

Let’s create something meaningful together. Drop your feedback in the comments or join the discussion on HiddenThreads. 🚀

💬 Share your thoughts below!

Together, we can shape the future of anonymous conversations. 🌟

Implementing Credential-Based Authentication with NextAuth.js in Next.js

Rajat Sharma — Tue, 28 Jan 2025 15:48:38 +0000

Implementing Credential-Based Authentication with NextAuth.js in Next.js

Authentication is crucial in controlling user access to web applications. While OAuth providers like Google and GitHub are popular, email/password-based authentication is still one of the most widely-used and secure methods. In this article, we will dive deep into how to implement credential-based authentication using NextAuth.js in a Next.js app. We’ll break down each step clearly, so you can follow along and implement this functionality in your own projects.

What is NextAuth.js?

NextAuth.js is an authentication library designed for Next.js applications. It simplifies handling authentication, including support for third-party providers (OAuth) like Google, GitHub, and Facebook. In this article, however, we’ll focus on using Credential Providers for email and password-based authentication.

What is the Credentials Provider?

The Credentials Provider in NextAuth.js allows you to authenticate users using custom credentials (e.g., email and password), giving you full control over how users log in and how their credentials are validated.

Why use the Credentials Provider?

Complete Control: You can define custom logic for login, error handling, and validation (e.g., checking if a user is verified).
Simple and Secure: Email/password remains one of the most secure and widely-used methods for authentication.

Let’s walk through the code setup and explain each step.

Step 1: Configure NextAuth.js with the Credentials Provider

The NextAuthOptions configuration object tells NextAuth.js how to handle the authentication process. Below is the full code snippet for setting it up:

import { NextAuthOptions } from "next-auth";
import CredentialProvider from "next-auth/providers/credentials";
import bcrypt from "bcryptjs";
import { dbConnect } from "@/lib/dbConnect";
import UserModel from "@/model/User";

export const authOptions: NextAuthOptions = {
  providers: [
    CredentialProvider({
      id: "credentials", // Unique identifier for the provider
      name: "Credentials", // Display name in the UI
      credentials: {
        email: { label: "Email", type: "text" },
        password: { label: "Password", type: "password" },
      },
      async authorize(credentials: any): Promise<any> {
        await dbConnect(); // Connect to the database

        try {
          const user = await UserModel.findOne({
            $or: [
              { email: credentials.identifier },
              { username: credentials.identifier },
            ],
          });

          if (!user) {
            throw new Error("No user found with this email or username");
          }

          if (!user.isVerified) {
            throw new Error("Please verify your account before logging in");
          }

          const isPasswordCorrect = await bcrypt.compare(credentials.password, user.password);
          if (isPasswordCorrect) {
            return user; // Successfully authenticated
          } else {
            throw new Error("Incorrect password");
          }
        } catch (err: any) {
          throw new Error(err);
        }
      },
    }),
  ],
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token._id = user._id?.toString();
        token.isVerified = user?.isVerified;
        token.username = user?.username;
        token.isAcceptingMessages = user?.isAcceptingMessages;
      }
      return token;
    },
    async session({ session, token }) {
      if (token) {
        session.user._id = token._id?.toString();
        session.user.isVerified = token?.isVerified;
        session.user.username = token?.username;
        session.user.isAcceptingMessages = token?.isAcceptingMessages;
      }
      return session;
    },
  },
  pages: {
    signIn: "/sign-in", // Custom sign-in page
    error: "/sign-in",  // Custom error page
  },
  session: {
    strategy: "jwt", // Use JWT for session management
  },
  secret: process.env.NEXTAUTH_SECRET, // Secret key to secure sessions and JWT tokens
};

Explanation of the Code

Providers: The Credentials Provider is used here to define the fields needed for login (email and password).
- id: The unique identifier for the provider (credentials in this case).
- credentials: The fields required for login (email and password).
- authorize(): This function handles the login logic. It checks if the user exists, if the account is verified, and whether the entered password matches the one stored in the database.
Callbacks:
- jwt: This callback is called when generating a JWT. We add custom data like the user's ID, username, and verification status.
- session: This callback is triggered when a session is created or updated. We store additional information from the JWT into the session object.
Pages:
- signIn: The URL path for the custom sign-in page.
- error: Custom error handling page for authentication failures.

Step 2: Create the API Route to Handle Authentication

Next, we need an API route to handle authentication logic. This is where the actual NextAuth.js authentication mechanism is invoked.

// pages/api/auth/[...nextauth].ts
import NextAuth from "next-auth";
import { authOptions } from "@/lib/authOptions"; // Import the authOptions configuration

export default NextAuth(authOptions); // Use the configuration to handle authentication requests

This file simply imports the authOptions from your configuration file and passes it to NextAuth(). The API route will automatically handle requests like logging in, managing sessions, and handling authentication errors.

Step 3: File Structure

To keep things organized, we can structure the project like this:

/lib
  /authOptions.ts        // Configuration for NextAuth.js
/model
  /User.ts               // User model for querying the database
/pages
  /api
    /auth
      [...nextauth].ts    // NextAuth API route

Step 4: How to Handle the Route in Next.js 13+

With the App Router (Next.js 13+), the code should look like this:

// app/api/auth/[...nextauth]/route.ts
import NextAuth from "next-auth";
import { authOptions } from "@/lib/authOptions"; // Import the configuration

const handler = NextAuth(authOptions);

export { handler as GET, handler as POST }; // Handle both GET and POST requests

This setup allows the route to handle both GET requests (e.g., fetching session info) and POST requests (e.g., logging in).

Conclusion

By following this guide, you should now be able to implement credential-based authentication using NextAuth.js in your Next.js application. With the flexibility of the Credentials Provider, you have full control over the authentication process, from user verification to password comparison.

If you found this tutorial helpful, feel free to share it with others on Dev.to, and don’t hesitate to ask any questions in the comments. Happy coding!

Let me know if you'd like me to modify or add anything further!

Forem: Rajat Sharma

OOP in C++ Explained: IS-A vs HAS-A Relationship (Inheritance vs Composition Guide)

OOP Relationships in C++: IS-A vs HAS-A (Inheritance vs Composition)

Table of Contents

1. IS-A Relationship (Inheritance)

Definition

Examples

Basic Syntax (C++)

Types of Inheritance

1. Single Inheritance

2. Multiple Inheritance

3. Multilevel Inheritance

4. Hierarchical Inheritance

Why Use Inheritance?

1. Code Reuse

2. Runtime Polymorphism

3. Extensibility

Inheritance Access Specifiers

Access Comparison Table

When to Use Inheritance

Correct Usage ✅

Wrong Usage ❌

2. HAS-A Relationship (Composition)

Definition

Examples

Basic Syntax

Object Composition (Strong Ownership)

Pointer Composition (Dynamic/Flexible)

Modern C++ with Smart Pointers (Recommended)

Composition with Dependency Injection

3. Composition vs Aggregation

Composition (Strong Ownership)

Aggregation (Weak Ownership)

Comparison Table

4. Key Differences

IS-A vs HAS-A Comparison

Visual Comparison

5. Design Principles

Golden Rule (Industry Standard)

Why Composition is Preferred

When to Use Inheritance

Liskov Substitution Principle (LSP)

6. Real-World Examples

Example 1: E-Commerce System

Example 2: Game Character System

Example 3: Logger System

7. Common Mistakes

Mistake 1: Using Inheritance for Code Reuse Only

Mistake 2: Deep Inheritance Hierarchies

Mistake 3: Violating Liskov Substitution Principle

8. Interview Questions

Q1: What is the difference between IS-A and HAS-A relationships?

Q2: Why is composition preferred over inheritance?

Q3: Can we use both inheritance and composition together?

Q4: What is the difference between Composition and Aggregation?

Q5: When should you use inheritance?

Q6: What is the Diamond Problem? How do you solve it?

Q7: How do you decide between IS-A and HAS-A?

Quick Decision Flowchart

Self-Test Exercises

Summary

Understanding Reciprocal Rank Fusion (RRF) in Retrieval-Augmented Systems

✨ What is Reciprocal Rank Fusion (RRF)?

🤔 Why Use RRF?

🛠 How Does RRF Work?

🧮 The RRF Formula

🔥 Flowchart for Visual Understanding

🧩 Simple Code Snippet for Learning

🎯 Conclusion

🌟 What's Next?

🚀 Stay Curious. Keep Building!

Are you curious about how Retrieval-Augmented Generation (RAG) actually works? Dive into this overview to gain a deeper understanding of the concept and its applications. This is Chapter 1, with more detailed insights coming soon. Stay tuned for further

An Introduction to Retrieval-Augmented Generation

An Introduction to Retrieval-Augmented Generation

Chapter1 - Introduction to Retrieval-Augmented Generation (RAG)

Overview

Table of Contents

What is RAG?

How does RAG work?

1. Indexing:

✅ Debouncing with `setTimeout` + `useEffect`

3️⃣ Debounce API call in `useEffect`

🔧 Bonus: Use `lodash.debounce` for Cleaner Code

1️⃣ Local Storage (`window.localStorage`)

2️⃣ Session Storage (`window.sessionStorage`)

3️⃣ HTTP-only Cookies (`Set-Cookie` header)