Vulcode
Portfolio

Panel klienta WaveHost

The client panel for a hosting provider: ordering and managing VPS and dedicated servers, a wallet, invoices and a referral program. A modern stack with secure authentication and a safe handshake to the game panel. The client runs everything from one place.

Panel klienta WaveHost
TL;DR

A hosting provider's client panel: ordering and managing VPS and dedicated servers, a wallet, invoices and a referral program. The most interesting part is the safe link to a separate game panel, so a client does not log in twice and accounts connect without the risk of attaching the wrong one - through a signed HMAC handshake.

Overview

WaveHost is a hosting provider that needed one place for its clients: you order a server, pay, refer others, all from the same panel. That part alone is craft work we had done before. The real challenge sat next to it: the provider already ran a separate game panel with its own accounts, and those two worlds had to be joined so the client felt one system, not two.

The simplest thing would be to make people log in twice and link an account manually by email. But that is a straight path to mistakes, and with account linking a mistake has a concrete price: attach someone else's account and you have a problem an ordinary sorry cannot undo. We wanted a link you can trust. This case study is mostly about that link.

Everything from one place

The foundation is the day-to-day the client comes back to. Ordering and managing servers covers both VPS and dedicated machines, with their state and config visible in one view. The client does not jump between tools to check what they have and what shape it is in.

Around that lives the rest of the service. The wallet and invoices sit side by side, so the balance, payments and documents form one whole, not three separate tabs to reconcile yourself. The referral program adds a referral link and a clear commission flow, wired into the same wallet. All of it stands on a modern stack with secure authentication, because this is a panel that holds money and server access.

2
server types from one panel (VPS and dedicated)
1
login instead of two
0
manual account linking by email

One login instead of two

The core of the project is joining the client panel with the existing game panel. From the client's side the problem is trivial and annoying at once: two accounts, two logins, two worlds they do not care about, because they just want to manage everything in one place. From the engineering side this is exactly the part where it is easy to do something dangerous.

The naive solution goes: let the client type their game-panel login and we attach it. The trouble is that anyone could then type someone else's login and attach themselves to an account that is not theirs. Manual linking by email is slow and just as leaky. We needed a way for one system to prove the client's identity to the other, without trusting anything that passes through the browser.

A signed handshake

The solution is an HMAC-based handshake. When the client clicks "link account" in the WaveHost panel, the panel generates a link carrying the user id, a timestamp and a signature computed with a secret only the two panels know. The game panel receives that link, recomputes the signature with its own secret and compares. If it matches, it knows the request really came from the WaveHost panel and not from someone who forged the URL.

What matters is what the browser never sees. The secret does not leave the servers, so even someone who observes or intercepts the link cannot compute a valid signature for another id. The timestamp closes the second hole: the link is short-lived, and the game panel simply rejects an expired token, so a sniffed link cannot be used later.

linkAccount.ts · ts
import { createHmac } from 'node:crypto';

function signLink(userId: string, secret: string): string {
  const ts = Date.now().toString();
  const mac = createHmac('sha256', secret).update(userId + '.' + ts).digest('hex');
  return userId + '.' + ts + '.' + mac;
}
!
Warning

The account-linking URL carries an HMAC signature and a timestamp. The game panel rejects a token that is expired or has a bad signature, so an intercepted or forged link will not attach the wrong account. The secret is known only to the two sides, never to the browser, which is why convenience cannot be traded for a hole.

What the finished product actually delivers

The client runs everything from one place. They order servers, manage VPS and dedicated machines, pay, refer others and watch the wallet without jumping between tools. The link to the game panel works on one click instead of an email exchange, so the provider's two systems feel like one to the client.

Underneath, that convenience is not paid for with security, because the handshake is short-lived and signed and the secret never reaches the browser. A forged or intercepted link will not attach the wrong account, because the server guards the boundary at the entry, not the interface. This is exactly the kind of solution the project was about: simple for the client, hard where it has to be hard.

More projects

More work from the same category - see how we tackle similar challenges.

Have a similar project?

Get in touch - a quote is free and comes back within an hour.