Social Media Ideas for Token-Based Authentication

Refresh Token Rotation in Node.js: Stopping Token Theft Without Logging Users Out

JWT-based authentication is simple to start with and surprisingly hard to get right. The naive setup of a long-lived access token stored in the browser is a security liability. The...

Implement on-behalf-of token exchange for multi-tenant agents with Amazon Bedrock AgentCore Gateway

Building multi-tenant agents with Amazon Bedrock AgentCore and Apply fine-grained access control with Bedrock AgentCore Gateway interceptors establish the conceptual foundation for...

JWT vs Session Tokens | What’s the Difference and Which Should You Use?

JWT vs Session Tokens: The One Sentence That Actually Matters If you've built more than one web app, you've had this argument with a teammate: "just use JWTs" vs "sessions are sim...

How Do You Log Someone Out of a Stateless System? JWT Invalidation on Logout

JWTs are one of those technologies that feel wonderful right up until you hit your first "log me out" requirement. Then you discover the awkward truth: the very property that makes...

Authenticate with Private Key JWT using Amazon Bedrock AgentCore Identity

This post explains how Private Key JWT client authentication works in AgentCore Identity and reviews the supported grant flows. We then walk through creating an AWS KMS signing key...

Role-Based Access Control in Node.js with JWT

Role-Based Access Control (RBAC) is a fundamental security pattern used to restrict system access based on user roles. When combined with JSON Web Tokens (JWT), it enables stateles...

HMAC-Signed Webhooks: Securing Your Event Stream

HMAC-Signed Webhooks: Securing Your Event Stream Webhooks are powerful—they let external systems react to your events in real time. But there's a catch: how do you know the web...

Future-Proofing JWT Security: Crypto-Agility, Post-Quantum Signatures, and IAM Migration

Today, applications are built around identity systems. All API gateways, microservices, mobile backends, and single sign-on flows require some form of authentication and authorizat...

n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer

n8n, the workflow automation platform, handed out the wrong accounts at login. On Enterprise instances configured to trust more than one external token issuer, it matched an incomi...

Week 9: Verifying the Token

Two pull requests merged this week and the most security-critical piece of the whole project went out for review on its own. This was the week the plan from week 7 started visibly...

Understanding OAuth 2.0 for Backend Developers

Modern applications rarely operate in isolation. Whether we are building a web app, mobile backend, or microservices architecture, our system often needs to access user data stored...

IAM authentication with OAuth 2.0 for Amazon MQ for RabbitMQ

IAM authentication with OAuth 2.0 lets clients connect to Amazon MQ for RabbitMQ using their existing IAM identity instead of static broker-local credentials. This post covers the...

Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway

When deploying AI agents with Amazon Bedrock AgentCore, organizations benefit from built-in modern support for OAuth 2.0, AWS Identity and Access Management (IAM), and API key auth...

Two Factor Authentication (2FA)

Tag1 Insights: A New Direction for Authentication in Drupal Core

Take Away At Tag1, we believe in proving AI within our own work before recommending it to clients. T...

Secure Foundations: Protecting Loyalty Data with RESTful APIs and OAuth 2.0

When you log into your digital bank account or swipe a credit card, you expect your financial data to be locked behind digital vault doors…Continue reading on Medium »

One Stolen Key, One Stolen Token: Why Machine Identity Is Cloud-Native's Quietest Crisis — and the Only Fix That Actuall...

On December 2, 2024, a security vendor called BeyondTrust noticed something wrong inside its own AWS account. By the time the investigation closed, the story that emerged was almos...

Авторизация по протоколу OAuth 2.0 в интеграциях

В интеграциях с внешними приложениями часто используется протокол OAuth 2.0. В этой статье разбирается практический сценарий: получение access_token, обновление токена, работа с ош...

Passkeys Explained Simply

You’ve probably seen that little prompt that says “Sign in with Face ID” or “Use a passkey” instead of the traditional password field. That’s a passkey. And no, it’s not just a pas...

Stolen Greatness Tokens Provide Microsoft 365 Access More Than Two Weeks After Phishing

Stolen Greatness authentication tokens are providing sustained, MFA‑approved access to victim Microsoft 365 tenants for more than two weeks after the initial phish, underscoring th...

OTP (One Time Passcode)

Designing Secure REST APIs With Spring Boot

Most Spring Boot APIs I’ve reviewed have a security configuration that was correct three commits ago. Then somebody added a new endpoint, the security config didn’t get the matchin...

SecretAuth – UX-решение для авторизации посредством приватного ключа

Мир сильно изменился с начала 21 века. В том числе, что касается систем авторизации. Мы продвинулись от авторизации через обычный логин и пароль к использованию централизованных се...

Spring Security: работа с JWT токенами

Всем привет! Данная статья посвящена регистрации и аутентификации с помощью JWT что помогает нам избавиться от тяжёлых сессий и куки и быть более крутыми и современными разработчик...