Topic 20 entries
Identity & Auth
OpenID Connect, OAuth, passkeys and step-up: who is acting, on whose behalf, and how strongly that was proven.
Authentication is where usability and security meet most directly. These pieces cover OpenID Connect and OAuth in practice, step-up authentication, and an honest look at passkeys.
Follow this topic: RSS JSON Feed Markdown
Essays
- Mastering JWKS: JSON Web Key Sets Explained
- JSON Web Encryption: Exploring JWE Token
- JWT vs OAuth 2.0: Understanding the Key Differences
- Step-Up Authentication: Elevating Security with OpenID Connect (OIDC)
- Passwordless: Critical Notes on FIDO2 Passkeys
- Passwordless Authentication: Future of Cybersecurity
- The Purpose of JWT: Stateless Authentication
- On Making Spring Security OAuth RFC-compliant
Field guide
- How does authorization work for MCP servers?
- How should people grant and revoke an agent's access?
- How does OAuth 2.0 Token Exchange keep provider tokens away from agents?
- What is inside a JWT?
- Should an agent use a robot account or delegated access?
- Where do OpenID Connect implementations break?
- Do login challenges and risk scoring stop account takeover?
- How secure are email-based password resets?
- How do attackers take over accounts?