Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
Post-Quantum Cryptography (PQC) is creating a rather awkward problem for PKI.
Read article: X.509 Certificates With More Than One Signature: Because You Can Never Have Too Many Cryptographic…Identity systems have a bad habit of starting with a simple question: Who are you?
Read article: IAM GovernanceThere is a security boundary in every browser that developers eventually run into.
Read article: CORS: Cross-Origin Resource SharingNote, We are exclusively talking about SAML2 in this story.
Read article: OAuth2 and SAML(RFC 7522): When Your Assertion Needs a PassportOAuth2 has a fairly straightforward model. A client authenticates to an authorization server, obtains an access token, and uses that token to access a protected resource.
Read article: OAuth2 JWT Bearer Tokens (RFC-7523): When a JWT Becomes Your OAuth2 CredentialRecently, Accuknox invited me to participate as a guest on a webcast discussing why pre-AI security fundamentals still matter.
Read article: Old Rules, New Tools: Why Pre-AI Security Fundamentals Still WinThe original three-legged OAuth2 use case has been a well-understood use case for a long-time.
Read article: OAuth 2.0 Token Exchange: When One Token Isn’t the Token You NeedOAuth2 was designed around the assumption that the client can open a browser.
Read article: OAuth2 Device Authorization Grant: OAuth2 for Devices That Can’t Really Do OAuth2Disclaimer: This article was written in Q3,2026. It is current as of that date. The OAuth 2.1 draft proposals have not yet been published as an RFC. So, some changes could still occur. Given the late stage of the process, it is unlikely it will change that much, but be aware that some changes could…
Read article: OAuth 2.1: How OAuth 2.0 Evolved into a More Secure Authorization FrameworkWe have spent decades building systems that ask people to prove who they are.
Read article: OID4VP: OAuth2 for the “Prove It” ProblemLooking for something specific? Browse all 124 topics.
