Install
Auth, Identity & Sessions
OAuth/OIDC, sessions, JWTs, SSO patterns, and security considerations.
- 8 Tracked terms
- Last 30 days Feed window
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.
Related topics
Latest in Auth, Identity & Sessions
OAuth scopes are not your app's authorization model
1+ day, 22+ hour ago (92+ words) OAuth scopes answer: "what APIs may this token call?" They do not answer: "may this user read this document?" A token with documents:read can still be used against every document ID the holder can guess, unless your API binds…...
Revoking the token didn't kill the backdoor
2+ day, 19+ hour ago (416+ words) Every identity-compromise runbook I have written, read or inherited has the same step near the top: revoke the tokens. Reset the password, kill the sessions, invalidate the refresh tokens, then go hunting. It is the right instinct. Against adversary-in-the-middle phishing,…...
Securely Authenticate Users with the Telegram Login Widget in PHP and Yii2
3+ day, 12+ hour ago (222+ words) This guide demonstrates how to build a secure backend validator in PHP to verify the Telegram Login Widget payload using HMAC-SHA-256, enforce strict expiration checks on the authentication timestamp, and map the validated Telegram ID to a user record in…...
You Protected the API… But Your JavaScript Is Telling Everyone Your Secrets
4+ day, 9+ hour ago (30+ words) The Frontend Security Mistake I Keep Seeing in Enterprise Applications “We secured the APIs behind an Identity Provider …...
SPL Token Was Replaced In Place: p-token, Explained
5+ day, 12+ hour ago (844+ words) Every token you have ever held on Solana that is not Token-2022 lives under one program: the classic Tokenkeg… address. It is the most-called program on the chain, it has not materially changed in years, and most people assume it…...
2,967 MCP servers advertise OAuth. 8% meet the July spec.
6+ day, 21+ hour ago (380+ words) I scanned every server in the official MCP registry and checked the ones that advertise OAuth against the 2026-07-28 authorization requirements. Read-only throughout: one initialize per host to see what it answers, then public metadata documents. No tool calls, no auth…...
Authentication vs Authorization: The Distinction Most Developers Get Wrong
6+ day, 19+ hour ago (338+ words) Two words. Nearly identical spelling. Completely different jobs in your system. If you’ve ever returned a 401 when you …...
JWT Exploits: Three Ways Trust Gets Misconfigured
1+ week, 5+ day ago (714+ words) Discover three real-world JWT vulnerabilities caused by misconfigured trust, alg confusion, weak secrets, and none algorithm abuse, and how to prevent them....
Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension
1+ week, 6+ day ago (1776+ words) JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside it. Usually, when something goes wrong, your first instinct is to look at yourself. What…...
SSO Without Giving the Server Your Keys
2+ week, 9+ hour ago (984+ words) Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person is, you mint a session. Every framework has a library for it. Then you try it on an app that encrypts everything…...