Tag: #jwt

한국어English日本語中文

← All posts

• The Complete Guide to Authentication and Authorization: Ten Misconceptions, Corrected From the Specs

  OAuth 2.0 is an authorization framework; OIDC is the authentication layer on top of it. This guide corrects the flows that fell out of the recommendations, the illusion of JWT validation, and the real trade-offs of token

  2026-08-15 · 25 min read #인증#인가#oauth#oidc#jwt

• JWT or Sessions, and When — Settling the Authentication Choice by Asking Where the State Lives

  The difference between JWT and sessions is not encryption or performance. It is one question: does authentication state live on the server or on the client? From that choice follows the fundamental weakness of JWT, the i

  2026-07-26 · 13 min read #web#jwt#session#authentication#security

• OpenID Connect Deep Dive — From the Authorization Code Flow to Discovery

  A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea

  2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#security

• Customizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice

  A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a

  2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#security

• Keycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice

  A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,

  2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwt

• OIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice

  Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate

  2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gateway

• Mastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities

  We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin

  2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptography

• Keycloak Integration Hands-On — Run It with Docker, Configure Realm/Client, Wire Up Spring Boot and Next.js (2025 Hands-On Guide)

  Don't build authentication yourself — use Keycloak. This is a follow-along hands-on: run Keycloak 26 with Docker, configure Realm/Client/User/Role, poke the OIDC endpoints with curl, and integrate a Spring Boot Resource

  2026-05-14 · 23 min read #keycloak#oidc#oauth2#authentication#authorization

• Frontend Security 2025 — XSS, CSRF, CSP, Trusted Types, JWT, OAuth, PKCE, Passkeys, Supply Chain, SRI (S6 E9)

  XSS still tops every CVE report. But 2024–2025 shipped real tools to defeat it: Trusted Types, CSP v3 with strict-dynamic, Sanitizer API. Passkeys replaced passwords for serious products. Supply-chain attacks made SRI +

  2026-04-15 · 6 min read #frontend#security#xss#csrf#csp

• OAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)

  OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal

  2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorization

• OAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey

  Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se

  2026-03-25 · 22 min read #oauth2#authentication#jwt#session#sso

• OAuth2 & JWT Complete Guide: Everything About Authentication and Authorization for Developers

  Everything about OAuth2 and JWT with practical code! Authorization Code/PKCE/Client Credentials flows, JWT structure and signature verification, Access/Refresh Token strategies, Session vs Token comparison, OIDC, securit

  2026-03-23 · 23 min read #oauth2#jwt#authentication#authorization#security

• Spring Boot Authentication Practical Guide — Session, JWT, SecurityContext, Cookie-Based Auth Complete Mastery

  Master how to implement session and JWT-based authentication in Spring Boot, from SecurityFilterChain and custom filters to SecurityContext and cookie configuration, with practical code examples.

  2026-03-08 · 14 min read #architecture#authentication#spring-boot#jwt#cookie

• SSO Cookie/JWT Authentication System Complete Guide — Framework-Specific Practical Series Index

  An overview of the complete flow of SSO, cookie, and JWT-based authentication systems, with a guide to the practical implementation series for Spring Boot, Django, React, and Next.js frameworks.

  2026-03-08 · 15 min read #architecture#authentication#sso#jwt#cookie

• SSO Integration Practical Guide - OIDC/OAuth2 + Cookie/JWT Hybrid Architecture, Token Rotation Complete Mastery

  Complete mastery of designing and implementing SSO with OIDC/OAuth2 and cookie/JWT hybrid architecture, covering token rotation, refresh strategies, and multi-service authentication with practical code.

  2026-03-08 · 20 min read #architecture#authentication#sso#oidc#oauth2

• Next.js App Router Authentication Practical Guide - Middleware, Server Action, HttpOnly Cookie, SSR Auth Complete Mastery

  Complete mastery of authentication implementation using middleware, Server Actions, and Route Handlers in Next.js App Router, covering HttpOnly cookies and SSR authentication patterns with practical code.

  2026-03-08 · 25 min read #architecture#authentication#nextjs#jwt#cookie

• React SPA Authentication Practical Guide — Cookie vs Storage, Axios Interceptors, XSS/CSRF Defense Complete Mastery

  Master everything about managing authentication state in React SPAs, from comparing cookies, localStorage, and in-memory storage to Axios interceptors, XSS/CSRF defense, with practical code examples.

  2026-03-08 · 20 min read #architecture#authentication#react#jwt#cookie

• Django Authentication Practical Guide - Sessions, DRF + SimpleJWT, Middleware, Cookie-based Auth Complete Mastery

  Complete mastery of session authentication and DRF SimpleJWT-based JWT authentication in Django, covering middleware, request.user, and cookie configuration with practical code.

  2026-03-08 · 18 min read #architecture#authentication#django#jwt#cookie

• OAuth 2.0 Mastery — Everything About Authentication and Authorization

  From the inner workings of OAuth 2.0 to Authorization Code, PKCE, Refresh Tokens, and OpenID Connect. Why does a single Google login button require such a complex protocol? We fully dissect it with code and sequence diag

  2026-03-02 · 7 min read #architecture#oauth2#security#authentication#authorization