Install
Auth, Identity & Sessions
OAuth/OIDC, sessions, JWTs, SSO patterns, and security considerations.
- 8 Tracked terms
- Last 30 days Feed window
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.
Related topics
Latest in Auth, Identity & Sessions
Securely Authenticate Users with the Telegram Login Widget in PHP and Yii2
10+ hour, 23+ min ago (222+ words) This guide demonstrates how to build a secure backend validator in PHP to verify the Telegram Login Widget payload using HMAC-SHA-256, enforce strict expiration checks on the authentication timestamp, and map the validated Telegram ID to a user record in…...
You Protected the API… But Your JavaScript Is Telling Everyone Your Secrets
1+ day, 8+ hour ago (30+ words) The Frontend Security Mistake I Keep Seeing in Enterprise Applications “We secured the APIs behind an Identity Provider …...
SPL Token Was Replaced In Place: p-token, Explained
2+ day, 10+ hour ago (844+ words) Every token you have ever held on Solana that is not Token-2022 lives under one program: the classic Tokenkeg… address. It is the most-called program on the chain, it has not materially changed in years, and most people assume it…...
2,967 MCP servers advertise OAuth. 8% meet the July spec.
3+ day, 20+ hour ago (380+ words) I scanned every server in the official MCP registry and checked the ones that advertise OAuth against the 2026-07-28 authorization requirements. Read-only throughout: one initialize per host to see what it answers, then public metadata documents. No tool calls, no auth…...
Authentication vs Authorization: The Distinction Most Developers Get Wrong
3+ day, 18+ hour ago (338+ words) Two words. Nearly identical spelling. Completely different jobs in your system. If you’ve ever returned a 401 when you …...
JWT Exploits: Three Ways Trust Gets Misconfigured
1+ week, 1+ day ago (714+ words) Discover three real-world JWT vulnerabilities caused by misconfigured trust, alg confusion, weak secrets, and none algorithm abuse, and how to prevent them....
Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension
1+ week, 3+ day ago (1776+ words) JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside it. Usually, when something goes wrong, your first instinct is to look at yourself. What…...
SSO Without Giving the Server Your Keys
1+ week, 4+ day ago (984+ words) Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person is, you mint a session. Every framework has a library for it. Then you try it on an app that encrypts everything…...
Build a Password + Google OAuth MVP with NestJS and brkpt-auth (in 15 Minutes)
1+ week, 5+ day ago (429+ words) The last post in this series looked at why hand-rolled NestJS auth tends to accumulate glue code as real requirements pile up, and introduced brkpt-auth: full source code installed into your project, structured around interfaces (ports) you implement (adapters), so…...
Fed up with repeated `aws sso login`? Fix your config!
1+ week, 5+ day ago (561+ words) If you juggle a lot of AWS accounts through IAM Identity Center, you know the ritual. You sit down, run a command, and get slapped with this: So you type aws sso login again. And again tomorrow. And again after…...