Tag: #authentication
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 23 posts
JWT or Sessions, and When — Settling the Authentication Choice by Asking Where the State Lives
The difference between JWT and sessions is not encryption or performance. It is one question: does authentication state live on the server or on the client? From that choice follows the fundamental weakness of JWT, the i
2026-07-26 · 13 min read #web#jwt#session#authentication#securityBuilding SSO with Keycloak — From Realm, Client, and Flows to the 2026 New Features
Instead of bolting a separate login onto each of 20 internal apps, SSO lets a single identity server stand in for all of them. This post makes sense of Keycloak — the open-source standard — through four core concepts (Re
2026-07-09 · 9 min read #keycloak#sso#oidc#security#devopsThe Rise of the Agentic Web — auth.md and the Era of AI Signing Up On Your Behalf
AI agents signing up for and acting on services on behalf of users — the agentic web — is rapidly becoming reality. We examine the idea of domain-root standards like the auth.md proposal that emerged in the WorkOS contex
2026-06-25 · 21 min read #ai#agent#authentication#oauth#web-standardsIngress-level Authentication — Applying SSO with oauth2-proxy and Forward Auth
A practical guide to implementing SSO at the Ingress level using the external auth pattern. We walk through wiring oauth2-proxy as a forward auth service to layer OIDC login onto multiple apps without touching applicatio
2026-06-14 · 18 min read #ingress#oauth2-proxy#sso#authentication#kubernetesPasskeys and WebAuthn in 2026 — FIDO2, Auth0, Clerk, Stytch, Logto, SuperTokens, Hanko Deep Dive
The password era is genuinely ending. iOS 18 Passwords app, Android 15 Credential Manager, WebAuthn Level 3 Conditional UI, and Hybrid transport (caBLE then CTAP 2.2) accumulated between 2024 and 2026 so that ordinary us
2026-05-15 · 19 min read #passkey#webauthn#fido2#passwordless#auth0Keycloak Integration Hands-On — Run It with Docker, Configure Realm/Client, Wire Up Spring Boot and Next.js (2025 Hands-On Guide)
Don't build authentication yourself — use Keycloak. This is a follow-along hands-on: run Keycloak 26 with Docker, configure Realm/Client/User/Role, poke the OIDC endpoints with curl, and integrate a Spring Boot Resource
2026-05-14 · 23 min read #keycloak#oidc#oauth2#authentication#authorizationOAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)
OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal
2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorizationAPI Gateway Complete Guide 2025: Kong, Envoy, AWS API Gateway, Auth/Rate Limiting/Monitoring
Everything about API Gateways! Kong vs Envoy vs AWS API Gateway vs Traefik comparison, routing, authentication (OAuth2/JWT/API Key), rate limiting (Token Bucket/Sliding Window), request transformation, caching, monitorin
2026-04-14 · 24 min read #api-gateway#kong#envoy#aws-api-gateway#rate-limitingApplication Security Engineering Guide — OWASP Top 10, Authentication, Encryption, DevSecOps
Everything about application security: OWASP Top 10 vulnerabilities, secure authentication/authorization, practical encryption, secure coding, and DevSecOps pipelines.
2026-04-13 · 16 min read #ai#security#owasp#authentication#encryptionREST API Design Best Practices 2025: Naming, Versioning, Error Handling, Pagination, Security
Everything about REST API design! Resource naming, correct HTTP method usage, status codes, error response standards, pagination (Cursor vs Offset), versioning (URL vs Header), authentication (OAuth2/JWT/API Key), OpenAP
2026-03-25 · 19 min read #rest-api#api-design#http#pagination#versioningOAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey
Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se
2026-03-25 · 22 min read #oauth2#authentication#jwt#session#ssoWeb Security OWASP Top 10 Complete Guide 2025: 10 Vulnerabilities Every Developer Must Prevent
Master the OWASP Top 10 2021 with code! Broken Access Control, Injection (SQL/XSS/Command), Cryptographic Failures, SSRF, Security Misconfiguration — principles, attack scenarios, defense code, and production checklists
2026-03-23 · 20 min read #security#owasp#xss#sql-injection#csrfOAuth2 & JWT Complete Guide: Everything About Authentication and Authorization for Developers
Everything about OAuth2 and JWT with practical code! Authorization Code/PKCE/Client Credentials flows, JWT structure and signature verification, Access/Refresh Token strategies, Session vs Token comparison, OIDC, securit
2026-03-23 · 23 min read #oauth2#jwt#authentication#authorization#securityComplete Guide to API Gateway Pattern: Rate Limiting, Authentication, and BFF Architecture Design
A deep dive into API Gateway patterns covering Rate Limiting algorithms (Token Bucket, Sliding Window), authentication/authorization strategies, BFF (Backend for Frontend) architecture, load balancing, circuit breakers,
2026-03-13 · 14 min read #architecture#api-gateway#rate-limiting#authentication#bffSpring Boot Authentication Practical Guide — Session, JWT, SecurityContext, Cookie-Based Auth Complete Mastery
Master how to implement session and JWT-based authentication in Spring Boot, from SecurityFilterChain and custom filters to SecurityContext and cookie configuration, with practical code examples.
2026-03-08 · 14 min read #architecture#authentication#spring-boot#jwt#cookieSSO Cookie/JWT Authentication System Complete Guide — Framework-Specific Practical Series Index
An overview of the complete flow of SSO, cookie, and JWT-based authentication systems, with a guide to the practical implementation series for Spring Boot, Django, React, and Next.js frameworks.
2026-03-08 · 15 min read #architecture#authentication#sso#jwt#cookieSSO Integration Practical Guide - OIDC/OAuth2 + Cookie/JWT Hybrid Architecture, Token Rotation Complete Mastery
Complete mastery of designing and implementing SSO with OIDC/OAuth2 and cookie/JWT hybrid architecture, covering token rotation, refresh strategies, and multi-service authentication with practical code.
2026-03-08 · 20 min read #architecture#authentication#sso#oidc#oauth2Next.js App Router Authentication Practical Guide - Middleware, Server Action, HttpOnly Cookie, SSR Auth Complete Mastery
Complete mastery of authentication implementation using middleware, Server Actions, and Route Handlers in Next.js App Router, covering HttpOnly cookies and SSR authentication patterns with practical code.
2026-03-08 · 25 min read #architecture#authentication#nextjs#jwt#cookieConcurrent Login Prevention Implementation Guide — Layer-by-Layer Strategies with IP, Session, JWT, and Nginx Including Practical Code
A comprehensive guide covering concurrent (duplicate) login control through IP-based, session-based, JWT-based, and Nginx-level approaches — with architecture, pros/cons, practical code, and operational checklists all in
2026-03-08 · 13 min read #architecture#security#authentication#session#nginxReact SPA Authentication Practical Guide — Cookie vs Storage, Axios Interceptors, XSS/CSRF Defense Complete Mastery
Master everything about managing authentication state in React SPAs, from comparing cookies, localStorage, and in-memory storage to Axios interceptors, XSS/CSRF defense, with practical code examples.
2026-03-08 · 20 min read #architecture#authentication#react#jwt#cookie