#Authentication
20 articles
Designing Secure API Tokens with NIST CSF 2.0: Working Backward from Protect and Detect
Design an API token feature such as Personal Access Tokens (PATs) by working backward from the six NIST CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover). Covers the DB schema, token format, scope checks, anomaly detection, secret scanning, and revocation with code examples.
8 Books for Learning Web Application Security (Auth and Secure Design)
A staged reading list of 8 books for learning web application security, from authentication and authorization to secure design: OAuth-based authorization, digital identity, and secure design and implementation. Each entry links to its full review.
Where Should You Store SPA Tokens? A BFF + Session Authentication Design
Explains where to store access tokens in an SPA (the danger of localStorage), a BFF + session design that keeps tokens out of the browser, and why starting token-less is often enough.
What is the Big Picture of Service-to-Service Authentication? mTLS, Token Exchange, SPIFFE, and Zero Trust
Organizes service-to-service authentication in microservices across three layers: network, token, and identity foundation. Covers mTLS, Token Exchange (RFC 8693), SPIFFE, Zero Trust (NIST SP 800-207), and BeyondProd.
OIDC Logout and Security Event Token (SET)
Explains OpenID Connect Front-Channel Logout and Back-Channel Logout, and how the Security Event Token (RFC 8417 SET) enables session revocation and event notification.
What is JOSE? An Overview of JWT, JWS, JWE, JWK, and JWA
An overview of the JOSE family (JWT/JWS/JWE/JWK/JWA). Learn the difference between JWT and JWS, the 3-part signed structure and 5-part encrypted structure, and how JWT BCP (RFC 8725) prevents alg confusion and none attacks.
Cryptography in Practice: TLS, JWT, and SSH
How everyday protocols such as TLS, JWT/JWS, and SSH combine symmetric keys, public keys, signatures, key exchange, and PKI, viewed through the three uses of a public key and backed by RFCs. The final part of a three-part cryptography series.
Three Uses of a Public Key: Signing, Encryption, and Key Exchange
A public key has just three uses: signing, encryption, and key exchange. This article sorts real-world applications such as SSH public-key auth, WebAuthn, mTLS, private_key_jwt, code signing, and container signing into these three, and clarifies how they differ from shared-key schemes such as HMAC, with primary sources.
パスキーのすべて: Adoption, UX Design, and Implementation
A review of Everything About Passkeys. From the context of passkeys' rise, password limits and phishing resistance, to WebAuthn and FIDO specifications, server- and platform-side implementation, login UX design, and operational pitfalls like device loss and recovery, it covers the whole picture in one volume.
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
A review of a comprehensive book on digital identity. It explains everything from concepts to implementation systematically and broadly, covering OAuth 2.0, OpenID Connect, SAML, zero trust, and decentralized identity, giving engineers who design and operate authn/authz platforms a wide perspective.
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
A review of Introduction to Digital Identity. A book that plainly explains the basics of authentication, authorization, and ID management for web services, with real examples. It spans the mechanisms of OAuth 2.0, OpenID Connect, and SAML through single sign-on, social login, and using IDaaS, an ideal primer.
OAuth 2.0 Explained: Complete Guide to Flows, Tokens, and Implementation
OAuth 2.0 explained from the specs (RFC 6749 and RFC 6750): the four roles, the four grant types, access and refresh tokens, endpoints, scopes, Bearer tokens, security considerations, and what OAuth 2.1 changes.
Summary of OpenID Connect 1.0 Specifications
Understand OpenID Connect specification, JWT structure, ID tokens, claims, and authentication flow details.
SAML 2.0 Explained: How SSO and Federated Identity Work
Understand SAML 2.0 and how it enables Single Sign-On (SSO), the roles of Identity Provider and Service Provider, and how it compares to OAuth 2.0 and OpenID Connect.
Session-based and Token-based Authentication Methods
A comprehensive comparison and explanation of session-based and token-based authentication methods, covering technical details and implementation considerations.
A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions!
A review of A Tutorial Guide to Understanding OAuth2.0 Without Just Going Through the Motions. An introductory book for understanding OAuth2.0 by organizing its mechanisms rather than using it on vibes. Easy to read, it is well suited to first grasping OAuth2.0 flows.
Resources for Catching Up on OAuth2 and OIDC
Explore OAuth2, OIDC, JWT, and authentication standards through comprehensive specifications, books, and implementation guides.
A Book to Understand the Differences Between OAuth, OAuth Authentication, and OpenID Connect
A review of a book that helps you understand the differences between OAuth, OAuth authentication, and OpenID Connect. It clearly sorts out these easily-confused concepts for beginners, offering a starting point for understanding the role and proper use of each.
Basics of Authentication and Authorization
Learn authentication and authorization fundamentals: identification, RBAC, ABAC, credential types, SSO, SAML 2.0, OAuth 2.0, and OpenID Connect with practical context.
Stateless and Stateful
Learn the difference between stateless and stateful protocols. HTTP, UDP, and IP are stateless; FTP, TCP, and SMTP are stateful. Covers session-based state management implications.