Notes on application security, API security, identity, and API management from the field. Articles are also published on Medium. Browse the archive by topic instead — 124 subjects.
I’ve touched on the topic of using JWT as an Access Token on several previous blog posts:
Read article: JWT as Oauth2 Access Tokens & Refresh Tokens— Invalidation: The Awkward RealityMost digital signatures have the subtlety of a foghorn.
Read article: BBS-2023: The Digital Signature That Knows When To Keep Its Mouth ShutIn 1996, I took my first Computer Science course in college. The professor encouraged us to use vi/vim. Later, at my first job out-of-school, the team was, also, using vi/vim. As the IDE craze took hold at the turn of the century (kind of weird typing that), I never really moved on from there. So,…
Read article: I Code in vi/vim and Loving It (And No, I’m Not Trying to Impress Anyone)The Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet…
Read article: How Many IETF RFCs Actually Become Standards?If you’ve ever opened the specifications surrounding SD-JWT Verifiable Credentials and thought, “Surely this is a straightforward document that defines a credential format.”
Read article: SD-JWT VC: The Identity Industry’s Latest Attempt to Win a Nobel Prize in AcronymsTravelers Rights. Or, lack thereof.
Read article: Your Phone vs. The Border: A Traveler’s Privacy Tour of the G20There is a special kind of optimism that exists in software development.
Read article: Input Validation: Because Users Are Creative, and Attackers Are More CreativeFor most corporate IT workshops, we are often trying to abstract as many security details away from application code as possible. I understand things may work differently at Big Tech / shops-with-many-competent developer resources. I initially started jotting down notes for this blog post while I…
Read article: Secure Code Reviews: Finding Security Issues Before Attackers DoFor decades, organizations have enjoyed a comfortable arrangement with modern cryptography.
Read article: Post-Quantum Migration Mistakes: How to Accidentally Recreate the Y2K Panic, But With More MathIdentity engineers have a complicated relationship with SAML.
Read article: The OAuth2/OIDC Debugger Has Learned a New Trick: SAML2 Support Is HereLooking for something specific? Browse all 124 topics.
