Install
Auth, Identity & Sessions
OAuth/OIDC, sessions, JWTs, SSO patterns, and security considerations.
- 8 Tracked terms
- Last 30 days Feed window
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.
Related topics
Latest in Auth, Identity & Sessions
How to Set Up Auth0 Organizations (SSO, Branding & Invitations)
16+ hour, 48+ min ago (298+ words) Stop Building Multi-Tenant Auth from Scratch. Use This Instead. Building a B2B SaaS application requires a complex multi-tenant infrastructure. In this technical walkthrough, Shreya Gupta and Lily Wisecarver demonstrate how to use Auth0 Organizations to effortlessly manage identity workflows for your business…...
1Password Setup: Passkeys & SSH Agent in 13 Steps [2026]
1+ day, 3+ hour ago (815+ words) You don’t need much to follow along, but a few version and account details matter given how fast 1Password has been shipping this year. If you’re migrating from another manager, keep your old vault unlocked and exportable until step 11 — don’t delete…...
JWT vs Session Tokens in Spring Boot: A Senior Dev’s Decision Guide
1+ day, 52+ min ago (34+ words) A practical decision guide on choosing between JWT and session tokens in Spring Boot. Three years ago I gave the same answer …...
Expo + Supabase GitHub Auth Broke 3 Times — Here's the Fix
2+ day, 1+ hour ago (891+ words) TL;DR: GitHub login in my Expo app broke three separate times. A deep link that went nowhere. A PKCE flow I wired backwards. A redirect URL with a typo. Each fix is copy-pasteable below. Total auth code is under…...
Secure Your.NET API in 15 Minutes: JWT Authentication Tutorial
1+ day, 22+ hour ago (33+ words) If your API is public by default, you don’t have an API. You have a data leak waiting to happen.” You don’t need …...
JWT Internals: What’s Actually Inside That Token You Trust
2+ day, 17+ hour ago (268+ words) Explore what's really inside a JWT: how the header, payload, and signature work together, get verified, and where security pitfalls often hide....
JWT Exploits: Three Ways Trust Gets Misconfigured
2+ day, 17+ hour ago (714+ words) Discover three real-world JWT vulnerabilities caused by misconfigured trust, alg confusion, weak secrets, and none algorithm abuse, and how to prevent them....
Silent HMAC Key Contamination: Uncovering a Logic Flaw in Burp's JWT Editor Extension
4+ day, 14+ hour ago (1776+ words) JWT Editor was shortlisted for “Best Auth & Access Control” in PortSwigger’s 2026 Burp Suite Extension Awards. This is the story of finding a silent bug inside it. Usually, when something goes wrong, your first instinct is to look at yourself. What…...
SSO Without Giving the Server Your Keys
5+ day, 2+ hour ago (984+ words) Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person is, you mint a session. Every framework has a library for it. Then you try it on an app that encrypts everything…...
JWKS and Session Verification Explained — 5 Recovery Paths for Fintech APIs
5+ day, 16+ hour ago (598+ words) Short answer: use JWKS verification to establish that a token was signed by an accepted issuer, then use session verification to decide whether that still-valid token should be allowed to act. For a fintech API rotating refresh tokens after a…...