This post walks through what a JWT is made of, decodes one by hand, and covers the mistakes I see most often. At the end I mention a free decoder I built for this. A JWT is three pieces joined…
A bot doesn't become a shopper because it keeps a session busy. For an existing e-commerce app adding phone one-time-code login, that operational constraint changes the refresh policy: activity can extend a session's idle deadline, but it must never move…
I run four small single-purpose sites: a Discord timestamp generator, a zalgo text generator, an image metadata remover and an emoji search. They're static Astro sites on Cloudflare, and the logic runs in the browser. I wanted AI assistants to…
Imagine walking into a boutique hotel. When you first arrive to book a stay, you fill out a guest registration card with your details—this is your signup flow. Once registered, the desk agent gives you a room keycard. On…
To secure your application, your backend must process the raw, encrypted query string provided by window.Telegram.WebApp.initData. This string includes a cryptographic hash generated by Telegram's servers. By running a server-side HMAC validation check against your Telegram Bot…
In April 2026, I independently reported OAuth credential exposure vulnerabilities in the official Python and TypeScript SDKs for the Model Context Protocol (MCP). Both findings came down to the same broken security assumption: an MCP server could influence which authorization server…
The algorithm field is another decision point. The token header names an algorithm, but the verifier must choose the acceptable key type and algorithm from its own configuration. Trusting a kid to select any key in a shared set, or…
Because OAuth attacks occur at the authorization layer after user authentication, stolen access and refresh tokens bypass MFA, survive password resets and grant durable access. While OAuth misuse occurs at a lower volume than traditional phishing attacks, these attacks may…
Register users with a hashed password, log them in with Goravel's JWT guard, read the token on later requests, log out and refresh tokens. Goravel v1.18, TaskFlow part 9. Tagged with go, webdev, tutorial, backend. Liquid syntax error: Unknown tag 'endraw' Templates…
CVE-2026-62374: Silent Claim-Set Reduction and Verification Bypass in SD JWT JS Vulnerability ID: CVE-2026-62374 CVSS Score: 7.1 Published: 2026-11-02 CVE-2026-62374 (GHSA-f9j6-8p6x-r9j6) is a verification bypass vulnerability in the OpenWallet Foundation SD JWT JS library (@sd-jwt/core and @sd-jwt/decode versions 0.19.0 and earlier). Due…
OAuth/OIDC, sessions, JWTs, SSO patterns, and security considerations.
An article joins this feed when it matches these terms. Each one is also a search of its own.