DEV Community

#authentication

User authentication mechanisms

Posts

👋 Sign in for the ability to sort posts by relevant, latest, or top.
Support Account Defense: Balancing JWKS Caching Against Live Session Introspection
theodorhawkins9251 profile

Support Account Defense: Balancing JWKS Caching Against Live Session Introspection

#authentication #security #api #architecture
Comments
8 min read
OAuth Flow CSRF: How a Missing State Parameter Enables Forced Authorization
roxdavirox profile
Davi

OAuth Flow CSRF: How a Missing State Parameter Enables Forced Authorization

#authentication #cybersecurity #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
roxdavirox profile
Davi

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
roxdavirox profile
Davi

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows
roxdavirox profile
Davi

PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

#authentication #cybersecurity #security
Comments
5 min read
SAML XSW: Signatures That Validate the Wrong Element
roxdavirox profile
Davi

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
roxdavirox profile
Davi

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
roxdavirox profile
Davi

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent
roxdavirox profile
Davi

JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent

#api #authentication #cybersecurity #security
Comments
5 min read
Rate Limiting Fails in Production Because It Counts the Wrong Dimension
roxdavirox profile
Davi

Rate Limiting Fails in Production Because It Counts the Wrong Dimension

#authentication #cybersecurity #production #security
Comments
6 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
roxdavirox profile
Davi

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check
roxdavirox profile
Davi

Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check

#authentication #cybersecurity #php #security
Comments
5 min read
LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope
roxdavirox profile
Davi

LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope

#api #authentication #cybersecurity #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
roxdavirox profile
Davi

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking
roxdavirox profile
Davi

The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking

#authentication #cybersecurity #javascript #security
Comments
4 min read
👋 Sign in for the ability to sort posts by relevant, latest, or top.