DEV Community

#authentication

User authentication mechanisms

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
What are JWT tokens and why your app needs them
_stefano_pinato profile

What are JWT tokens and why your app needs them

#dotnet #security #webdev #authentication
1
Comments
4 min read
Node.js SMS OTP Login Without Webhooks: Polling, Retry, Resend, and Abuse Prevention
peterparker8991 profile

Node.js SMS OTP Login Without Webhooks: Polling, Retry, Resend, and Abuse Prevention

#node #sms #authentication
Comments
7 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
rxkov profile
Rxkov

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
SAML XSW: Signatures That Validate the Wrong Element
rxkov profile
Rxkov

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
rxkov profile
Rxkov

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
OAuth Flow CSRF: How a Missing State Parameter Enables Forced Authorization
rxkov profile
Rxkov

OAuth Flow CSRF: How a Missing State Parameter Enables Forced Authorization

#authentication #cybersecurity #security
Comments
5 min read
OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced
rxkov profile
Rxkov

OAuth Access Token Leakage via Logs and APM: The RFC 6750 Warning Nobody Enforced

#api #authentication #cybersecurity #security
Comments
5 min read
PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows
rxkov profile
Rxkov

PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

#authentication #cybersecurity #security
Comments
5 min read
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
rxkov profile
Rxkov

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
Rate Limiting Fails in Production Because It Counts the Wrong Dimension
rxkov profile
Rxkov

Rate Limiting Fails in Production Because It Counts the Wrong Dimension

#authentication #cybersecurity #production #security
Comments
6 min read
Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check
rxkov profile
Rxkov

Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check

#authentication #cybersecurity #php #security
Comments
5 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
rxkov profile
Rxkov

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
rxkov profile
Rxkov

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope
rxkov profile
Rxkov

LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope

#api #authentication #cybersecurity #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
rxkov profile
Rxkov

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.