The SCIM tax: provisioning is plumbing, not a premiumSCIM is a standardized CRUD API whose most important verb is the one that turns an ex-employee's account off. Vendors price it at $125 a month per connection, or park it in the enterprise tier next to SSO. Here is what a SCIM connection actually costs to serve, and why charging for deprovisioning is charging for security.4 min read·authagonal.hashnode.devJul 22
Your password-reset form is a free email cannonAn unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their reset form into a spam cannon, billed to your sender reputation. The fix, without leaking which emails have accounts.4 min read·authagonal.hashnode.devJul 14
Your backup quietly resurrects the users you deletedAzure Table Storage and DynamoDB have no delete markers, so a deleted row just vanishes, which means your incremental backup never sees the delete at all. Restore that backup and the user you offboarded is back, with the password you rotated away from. Here is why deletes have to be first-class, and the one table that makes them so.4 min read·authagonal.hashnode.devJul 12
We run a whole auth system on stores that only know get and putAzure Table Storage gives you a partition key, a row key, and almost nothing else. No joins, no secondary indexes worth the name, no increment. We run a multi-tenant auth system on it anyway. The patterns that make it work, and what you give up versus SQL.6 min read·authagonal.hashnode.devJul 10
One hyphen, two tenants, one signing keyTwo of our tenants were quietly the same tenant: same database, same token-signing key, different names. The cause was a one-line helper that sanitized slugs by stripping hyphens, turning a unique identifier into a non-unique one. Here's how a lossy string transform became a cross-tenant takeover, and why we found it before you did.6 min read·authagonal.hashnode.devJul 7
