auth-and-identity
OAuth 2.0 and OIDC: A Backend Engineer's Guide to Login
Here is the question OAuth was invented to answer: how do you let an app do something on your behalf without handing it your passw…
#authentication
4 posts RSS
auth-and-identity
Passkeys and WebAuthn: How Passwordless Login Actually Works
A password is a secret you and the server both know. That is the original sin of the whole scheme: because the server has to store…
auth-and-identity
JWT vs PASETO vs Session-Based Auth
Are JWTs safe? Should you switch to PASETO? Is session-based auth outdated? In this guide, we’ll compare modern token systems in d…
auth-and-identity
How to Prevent Replay Attacks with JWTs: JWS vs JWE and Fingerprint Validation in Node.js
In this post, we’ll explore what replay attacks are, how JWS and JWE differ, and how to generate + validate session fingerprints u…