SGSahil Guptainsahilxdev.hashnode.dev·4h ago · 8 min readSessions vs JWT vs Cookies: How Does a Server Remember You?How does a server remember that you are logged in? You log in once. Then you open ten more pages, and the app never asks for your password again. Many beginners think the server simply "remembers" the00
SMSatyajit Mishrainblogs.satyajitmishra.me·20h ago · 8 min readSpring Security Explained: Understanding Authentication, JWT, and OAuth2 from the Inside OutSpring Security Explained: What Really Happens Behind Every Login Request? When I first started learning Spring Security, I was overwhelmed by terms like Security Filter Chain, Authentication Manager,00
EBElijah Browninelijahbrown.hashnode.dev·1d ago · 10 min readYour AI-built app's signup is open to anyone who calls the APIIf you built your app with Lovable, Bolt or Cursor on Supabase, your signup form is a suggestion. The form runs in the browser, and so do the Supabase URL and the anon (or publishable) key it uses. An02F
CACiphemic academiainciphemicacademia.hashnode.dev·1d ago · 13 min readPasswords vs. Passkeys vs. MFA: How CVS Health Cut Account Takeover Fraud by 98%Passwords vs. Passkeys vs. MFA: How CVS Health Cut Account Takeover Fraud by 98% CVS Health rolled out passkeys across its platform and measured a 98% reduction in account takeover fraud. Around the s00
EBElijah Browninelijahbrown.hashnode.dev·1d ago · 7 min readScreening Supabase signups before the user is createdMost signup forms check the shape of what people type and stop there. That catches typos, but not a well formed address at a known throwaway email provider, or a phone number that is valid on paper bu00
OFOluwaseyi Fatunmoleinfreecodecamp.org·2d ago · 22 min readAPI Authentication & Authorization: An Engineering Deep Dive into Mechanisms, Trade-offs, and Failure ModesEvery API has some form of authentication. But having authentication and getting it right are two completely different things. I've reviewed production systems where JWTs had no expiry. Systems where 00
KDKajal Dhanjalinkajalbuilds.hashnode.dev·4d ago · 9 min readWhat an MFA prompt actually proves.Every MFA prompt answers one narrow question: did someone have this factor, at this moment? That is a useful question. It is also not the question most of us think MFA is answering. We treat a complet02I
MMihai_LeanZeroinleanzero.hashnode.dev·5d ago · 24 min readBitbucket app passwords: move to API tokensHow to Migrate Off Bitbucket App Passwords Without Breaking Git (2026) Key takeaways Pick the credential per consumer: an API token for a human, a repository access token for CI. A bot on someone's p00
MMihai_LeanZeroinleanzero.hashnode.dev·5d ago · 17 min readBitbucket app passwords removal: what breaksBitbucket App Passwords: What Actually Breaks, and Why Your Fix Didn't Work (2026) Key takeaways In the final brownout week app passwords worked for only four one-hour gaps a day — 05:00, 11:00, 17:000
ZZyVOPinblog.zyvop.com·6d ago · 15 min readStop Logging Out Innocent Users: Building Production Refresh Token Rotation with Token Family Revocation in RedisEvery engineering team that implements JWT authentication eventually runs into the dilemma of session lifetime. If you issue long-lived access tokens (e.g., 30 days), you lose the ability to quickly r00
