У нас есть MCP дома
Всем привет! Меня зовут Петрович и я работаю техлидом java команды в небольшом международном финтехе. В прошлый раз я рассказывал, как мы меняли Red…
DevOps
⚑ Report a ProblemLatest DevOps news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
JWT Refresh Tokens: How They Make Login Systems Safer and More Practical
When building a modern web application, authentication is one of the first things we need to think about. A simple login system sounds easy: User en…
Easily setup Vault for Cursor cloud agents
One of the easiest and most helpful features of Cursor is Cloud Agents. With often 1 click you can have an agent in an ephemeral environment that yo…
JWT auth without the confusion
The mental model that fixes everything JWT is just a token format . It is not authentication, not a session, and not a database. Once you separate t…
JWT auth without the confusion
JWT auth without the confusion JWTs are everywhere, but they're often misunderstood. Let's strip away the jargon and see what they actually are, how…
JWT Validation: Verifying Tokens for Authentication and Authorization
JWT Validation: Verifying Tokens for Authentication and Authorization A practical guide to JWT validation — the process of checking a JSON Web Token…
Implementing JWT Refresh Token Rotation for Video API Clients
A refresh token leaked out of one of our Android TV clients last winter. Not through a server breach — through a rooted device running a sideloaded…
Zero Human Auth for AI Agents: How to Replace OAuth with Cryptographic Passport
Your AI agent needs to log into a customer's dashboard at 3 a.m. You cannot ask a human to click Allow . The agent has no browser. It cannot complet…
Top 10 Free Online Tools Every Developer Should Bookmark
Top 10 Free Online Tools Every Developer Should Bookmark Disclosure: I built these tools after repeatedly running into the same development tasks ov…
Building AutoStack.Identity: A Zero-Dependency .NET 10 Library for SAML 2.0, JWT, and XML Signing
The Problem That Started This We were building a healthcare connectivity platform — multi-tenant, Azure-hosted, integrating with enterprise IdPs via…
JWT in Node.js: How It Works, 5 Errors That Compromise Your API, and Refresh Token with Rotation
A dev submitted a PR with CPF and password hash inside the JWT payload. He thought Base64 was encryption. The reviewer rejected it, opened an urgent…
Stop Storing JWTs in localStorage: A Security Guide for Web Developers
When I first learned about JSON Web Tokens (JWTs), I thought I had authentication figured out. The tutorial showed me this simple line: localStorage…
Authentication vs. Authorization: A Deep Dive Every Backend Engineer Must Know
This post is an in-depth breakdown of Authentication (Who are you?) and Authorization (What are you allowed to do?). In the early days, identity was…
Inside the Auth Service: From Token Validator to Policy Decision Point
Most auth services start simple — verify the token, return 200 or 401. Then requirements accumulate. Tenant isolation. Service accounts. Token revoc…
JWT verification in production: an 8-check field guide
A correct JWT verifier does eight things. Most production verifiers I have read do four or five of them. The other three or four get skipped because…
We rotated our JWKS without overlap. Here is the 4-minute window that broke prod.
The on-call alert at 02:14 said auth_5xx_rate spiked from 0.01 to 31.4 . Not a deploy window. Not a traffic spike. Just thirty-one percent of authen…
Three JWT bugs that ship to prod silently — and the 5-line CI test that catches them
Your auth tests pass. Your token verification works. Then your identity provider rotates a key at 02:47, your service hasn't refreshed its JWKS cach…