Install
Identity, Auth & Access
OAuth/OIDC, SSO, policy engines, and permissions at scale.
- 8 Tracked terms
- Last 30 days Feed window
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.
Related topics
Latest in Identity, Auth & Access
Okta Unveils AI Agent Security Blueprint Alliance at Oktane
8+ hour, 53+ min ago (899+ words) Okta NASDAQ: OKTA outlined its strategy for securing artificial intelligence agents at its Oktane event, introducing an industry “Blueprint Alliance,” expanding its Agent SSO standardization efforts and highlighting the generally available Okta for AI Agents platform. The company said AI…...
Read-only user impersonation in Rails
11+ hour, 30+ min ago (482+ words) We built it and ran it in production. Last week we pulled it out into a gem called viewing_as. This post is about the decisions we made that may transfer to your app as well. None of them refuse writes, or…...
Okta's Blueprint Alliance Aims to Secure AI Agents
1+ day, 11+ hour ago (229+ words) Founding members joining Okta include Amazon Web Services (AWS), Google Cloud, Salesforce, ServiceNow, CrowdStrike, Databricks, Docker, Zscaler, Proofpoint, Lovable, and Wiz. The group also counts GE Appliances and World Central Kitchen as strategic advisors. Okta said all participants are in…...
OAuth scopes are not your app's authorization model
1+ day, 22+ hour ago (92+ words) OAuth scopes answer: "what APIs may this token call?" They do not answer: "may this user read this document?" A token with documents:read can still be used against every document ID the holder can guess, unless your API binds…...
Revoking the token didn't kill the backdoor
2+ day, 19+ hour ago (416+ words) Every identity-compromise runbook I have written, read or inherited has the same step near the top: revoke the tokens. Reset the password, kill the sessions, invalidate the refresh tokens, then go hunting. It is the right instinct. Against adversary-in-the-middle phishing,…...
Permissions and Authorisation: A Practical Playbook
3+ day, 5+ hour ago (808+ words) Authorisation is a domain capability, not a collection of scattered endpoint conditionals. For every protected operation, decide consistently whether a verified principal may perform a business action on a specific resource in a defined context—and enforce that decision server-side…...
Securely Authenticate Users with the Telegram Login Widget in PHP and Yii2
3+ day, 12+ hour ago (222+ words) This guide demonstrates how to build a secure backend validator in PHP to verify the Telegram Login Widget payload using HMAC-SHA-256, enforce strict expiration checks on the authentication timestamp, and map the validated Telegram ID to a user record in…...
Who watches the watchmen? Sam Altman's pledge is really an identity management problem
5+ day, 16+ hour ago (691+ words) After Sam Altman announced that OpenAI will adopt the model Anthropic proposed and grant outside overseers "employee-level access" to its development systems, Israel Duanis, CEO of Linx Security, writes that, "the security pledge is only as good as the infrastructure…...
You Protected the API… But Your JavaScript Is Telling Everyone Your Secrets
4+ day, 9+ hour ago (30+ words) The Frontend Security Mistake I Keep Seeing in Enterprise Applications “We secured the APIs behind an Identity Provider …...
Separate who can grant from who can act
5+ day, 9+ hour ago (90+ words) In many apps, anyone with an “admin” role can both use privileged actions and hand those same powers to other people. That mixes two different privileges: If the same role covers both, a compromised admin account — or a confused admin…...