Practical engineering tips, design theory and performance breakdowns — written for developers and founders who like their advice tested in production.
Filtering by tag #authentication — clear
You don't need to be a security specialist to avoid the bugs attackers exploit most. A practical checklist covering injection, XSS, CSRF, access control, secrets, dependencies and headers.
Read →
JWTs are popular, but popular isn't the same as right for your app. A clear comparison of sessions and tokens, where each one shines, and the storage mistakes that create security holes.
Read →
"Sign in with Google" looks like one button but involves redirects, codes, tokens and a few important security checks. How OAuth 2.0 and OpenID Connect work, and how to implement them safely.
Read →
Password reset is one of the most attacked features in any app. How to generate and store reset tokens, avoid leaking which emails exist, expire and invalidate correctly, and protect users after a reset.
Read →