DEV Community

#authentication

User authentication mechanisms

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint
rxkov profile
Rxkov

Working: Magic Link Tokens Live in Your Logs — And TOTP Has a Second Endpoint

#authentication #cybersecurity #infosec #security
Comments
5 min read
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
rxkov profile
Rxkov

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows
rxkov profile
Rxkov

PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows

#authentication #cybersecurity #security
Comments
5 min read
Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check
rxkov profile
Rxkov

Type Juggling in API Authentication: How Sending `true` Bypasses a Password Check

#authentication #cybersecurity #php #security
Comments
5 min read
Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page
rxkov profile
Rxkov

Working: Device Flow Phishing -- The OAuth Attack That Uses the Real Login Page

#authentication #cybersecurity #infosec #security
Comments
5 min read
API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them
rxkov profile
Rxkov

API Session Fixation Is Three Attacks, Not One — and Rotating Tokens Blocks None of Them

#api #authentication #cybersecurity #security
Comments
5 min read
JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent
rxkov profile
Rxkov

JWT Vulnerabilities Are API Design Bugs: Three Implementation Decisions That Betray Cryptographic Intent

#api #authentication #cybersecurity #security
Comments
5 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
rxkov profile
Rxkov

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope
rxkov profile
Rxkov

LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope

#api #authentication #cybersecurity #security
Comments
5 min read
Rate Limiting Fails in Production Because It Counts the Wrong Dimension
rxkov profile
Rxkov

Rate Limiting Fails in Production Because It Counts the Wrong Dimension

#authentication #cybersecurity #production #security
Comments
6 min read
The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking
rxkov profile
Rxkov

The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking

#authentication #cybersecurity #javascript #security
Comments
4 min read
Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing
rxkov profile
Rxkov

Three Signal Channels Leak Valid Account Lists Before Authentication Completes: Status Code, Response Body, and Timing

#api #authentication #cybersecurity #security
Comments
5 min read
OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability
rxkov profile
Rxkov

OAuth 2.0 redirect_uri Bypass: The 5-Condition Matrix That Determines Exploitability

#authentication #cybersecurity #infosec #security
Comments
6 min read
Authentication for AI Agents: Lessons We Can Borrow from Enterprise Identity
neospeed83 profile

Authentication for AI Agents: Lessons We Can Borrow from Enterprise Identity

#authentication #ai #security
Comments 1
3 min read
Self-Hosted SSO from Scratch with Laravel Passport
cammanhhoang profile

Self-Hosted SSO from Scratch with Laravel Passport

#laravel #sso #authentication #tutorial
1
Comments
33 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.