SSE Streaming & Cancellation

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R08 — MDN Server-Sent Events lifecycle

   R01 — FastAPI streaming

   R09 — PostgreSQL constraints, indexes & transactions

   R03 — OWASP API BOLA

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Implement Server-Sent Events (SSE) streaming and /reset. *Lab:* Verify that a disconnected client cancels in-flight model generation and tool execution rather than leaking compute. (Optional UI hook: connect minimal React streaming view with safe Markdown).

   Implement SQL schema, ownership foreign keys, indexes, and migrations for conversation history. *Lab:* Run IDOR/BOLA tests across read, update, and delete operations on persisted conversations.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 11 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Client-disconnect cancellation test + SQL tenant/owner isolation test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R01Python, FastAPI & Pydantic↗ fastapi.tiangolo.com

  FastAPI tutorial, request bodies, dependencies, async, and Pydantic model validation.

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R08MDN: Server-Sent Events (SSE)↗ developer.mozilla.org

  EventSource interface, event stream wire format, connection lifecycle, cancellation, and reconnection.

• R09PostgreSQL Documentation↗ postgresql.org

  Foreign-key constraints, indexes, ACID transactions, row-level security (RLS), and query planning.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsMDN Web Docs
  Server-sent events - Web APIs | MDN

  Defines the event-stream wire format, EventSource lifecycle, and reconnect behaviour, which is what you implement for token streaming and what fires when a client disconnects mid-generation.

  R08checked 2026-11-11
• videoHussein Nasser · 29:48
  Server-Sent Events Crash Course

  Explains the one-way stream over a single HTTP response, keep-alive comments, and connection lifecycle, which is the basis for detecting a dropped client and cancelling work.

  R08M5checked 2026-11-11
• videoMicrosoft Developer · 18:19
  Everything you need to know about Postgres Row Level Security | POSETTE 2024

  Shows policies keyed to the current principal so a query for conversation rows physically cannot return another owner's rows, the database backstop behind your BOLA tests.

  R09checked 2026-11-11
• articlegermano.dev
  Server-Sent Events: the alternative to WebSockets you should be using

  Explains why SSE survives proxies and reconnects automatically, and where the single-direction limit applies, which decides whether streaming tokens needs WebSockets at all.

  R08checked 2026-11-11
• repoGitHub
  sysid/sse-starlette

  EventSourceResponse implementation with ping keep-alives and client-disconnect signalling, which is how a disconnected browser aborts the in-flight model call instead of leaking compute.

  R08M5checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.