YUYasvanth Udayakumarinyasvanth.hashnode.dev·8h ago · 8 min readThe Cold Start TaxPart 1 of 2 on Context Auth, an experiment I've been building. A small annoyance that turns out to be structural You sign up for something new. Before it does anything useful, it interviews you. What'00
CDCoding Dropletsincodingdroplets.com·15h ago · 9 min readSending SignalR Messages to a Specific User in ASP.NET Core with IUserIdProviderThe requirement sounds trivial until you try it. A background job finishes and exactly one person needs to know, on whichever devices they happen to have open. The first instinct is to store connectio00
PKPRINCE KUMARinprincekumar-engineer.hashnode.dev·1d ago · 8 min readSecuring Apps: Password Hashing, RBAC, OAuth, and OpenID ConnectINTRODUCTION "How does a website know who you are?" Imagine opening GitHub. You enter your email and password. You click Login. Within seconds, you're viewing your private repositories. But how did 00
RMRodrigo Mansueliinblog.mansueli.com·1d ago · 13 min readAutomating Sign in with Apple Secret Rotation on SupabaseMost OAuth providers give you a client secret once and let you forget about it. Apple doesn't. Sign in with Apple's client secret is a JWT you sign yourself, and Apple hard-caps its exp claim at 6 mon10
TATanitoluwa Adenugainadenugatani.hashnode.dev·1d ago · 6 min readlocalStorage, sessionStorage and cookies: The Auth Token Decision Most Tutorials Get WrongMost tutorials teach localStorage first. Here is what they leave out. Most tutorials teach localStorage first. Some mention sessionStorage as the safer upgrade. Very few talk about what actually happ00
HFHussain Fakhruddininsultanbyte.com·1d ago · 9 min readPasskeys for MENA Apps: Build the Recovery Path FirstPasskey demos usually begin at the pleasant part: a biometric prompt appears, the user approves it, and the session opens. Production systems have to handle a less polished moment. The user has replac10
SMSyed Muhammad Aliindevstacked.hashnode.dev·2d ago · 23 min readSession vs JWT: Which Should You Use in Next.js 16?You're building a login flow in Next.js 16, and you hit the question every auth tutorial glosses over: should the logged-in state live in a session or a JWT? Half the guides you find use one, half use00
Rrathsarainrr-cyber.hashnode.dev·5d ago · 15 min readIdentity Foundations: Everything Before OAuthBefore any protocol makes sense on its own terms, a few things underneath it need to be settled first: what authentication and authorization actually are as distinct concepts, how identity gets carrie00
AKAshutosh Krishnainfreecodecamp.org·5d ago · 45 min readCSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation [Full Handbook]If you've ever built a web application or configured Spring Security, you've almost certainly encountered Cross-Site Request Forgery (CSRF). In my previous guide, How OAuth 2.0 Works: A Practical Guid00
MHMuiz Harunaindevdesiignn.hashnode.dev·6d ago · 4 min readWeb Security: Understanding JWTJWT: JSON Web Token JWT is a standard for safely passing claims, pieces of information or assertions made about a subject, in a space-constrained environment. Its key features are compactness, simplic10
