Apr 29 · 4 min read · Over the past few days, I set out to understand OAuth 2.0 and OpenID Connect (OIDC) beyond surface-level usage. Instead of relying on libraries, I tried to build a minimal version of the flow myself.
Join discussion
Apr 27 · 16 min read · If you've been storing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as GitHub Secrets to deploy to AWS, you're not alone. It's the most common approach and it's also one of the biggest security risks i
Join discussion
Apr 20 · 6 min read · If you have ever used Google Login, GitHub Login, or "Sign in with X", you have used OpenID Connect (OIDC). In this guide, we will build a production-style OIDC Authorization Server, step by step, usi
Join discussion
Feb 19 · 5 min read · When designing a passwordless-first PWA architecture, the diagram looks elegant. In production, elegance collides with: Browser inconsistencies Institutional identity constraints Support tickets Device lifecycle chaos Monitoring blind spots Le...
Join discussion
Feb 19 · 5 min read · When teams adopt WebAuthn or FIDO2, the excitement is understandable: No passwords. No phishing. No credential stuffing. Biometric UX. Public-key cryptography. It feels like the final answer. But WebAuthn answers exactly one question: Can thi...
Join discussion
Feb 18 · 6 min read · WebAuthn gave us phishing-resistant, device-bound authentication.But devices get lost. Browsers reset. Users switch laptops. Institutions manage identities centrally. That’s where OIDC (Feide) enters — not as a competitor to passwordless, but as stru...
Join discussion
Feb 16 · 6 min read · Modern authentication diagrams are clean. Real systems are not. My architecture intentionally combines: WebAuthn (FIDO2) for phishing-resistant authentication Feide (OIDC) for federated identity, recovery, and bootstrap SQL Server for credential p...
Join discussion
Feb 15 · 6 min read · Security engineers love cryptography because it is clean. Humans are not. The strongest authentication protocol in the world can be undone by: a confusing error message, an unclear retry flow, a missing recovery path, or a user who simply wants t...
Join discussion
Feb 14 · 6 min read · By this point in the series, we’ve established three things: Passwords are structurally fragile. WebAuthn provides phishing-resistant, device-bound authentication. OpenID Connect provides portable, federated identity. Now comes the harder questi...
Join discussion
Feb 12 · 6 min read · If WebAuthn answers the question: “Can this device prove control of a credential right now?” OpenID Connect answers a different question entirely: “Who is this person across systems, time, and organizations?” Modern authentication systems fail wh...
Join discussion
