OAuth Test Tenants Need Email Trust Boundaries
OAuth tests often stop at the redirect. That misses an important part of the trust story: what happens when a user must prove control of an email ad…
DevOps
⚑ Сообщить о проблемеПоследние новости DevOps от Tech News
Все темы
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
OAuth Email Verification Needs a Proof-Carrying Test
OAuth login is often treated as complete when the provider callback returns a verified email address. Many applications then send a verification mes…
Issuerd: a Keycloak-compatible IAM in Rust — one binary, 3,907 OIDC conformance checks, zero failures
If you've operated Keycloak in production, you know the tax: a JVM that wants gigabytes before it serves a single login, container startup measured…
Debugging Claude Code and Google MCP Quirks
This article provides a step by step investigation of why Claude Code needs a fresh Google sign-in every hour for the Google Workspace remote MCP se…
A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap
A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap Revocation is the part of identity that nobody tests I…
OAuth Callback Logs Need a Redaction Boundary
OAuth callback handlers are usually reviewed for the right reasons: state validation, PKCE, redirect URI checks, and token exchange errors. Logging…
Don't Ship Dev Keys! Set Up Production-Ready Google OAuth in React
Learn how to integrate production-ready Gmail / Google Sign-In into your applications using Auth0. In this complete, step-by-step tutorial, Layla (S…
Deploying Logto as a GCP Identity Platform Alternative
Google Cloud Identity Platform is Google's managed CIAM service for web and mobile applications, providing user account management, customizable aut…
Deploying Logto as an AWS Cognito Alternative
AWS Cognito is Amazon's managed authentication service for web and mobile applications, providing User Pools, Identity Pools for federated AWS resou…
Deploying Ory Hydra: An Open-Source OAuth 2.0 and OpenID Connect Server
Ory Hydra is an open-source OAuth 2.0 Authorization Server and OpenID Connect (OIDC) provider. Unlike identity platforms that bundle user management…
MCP Auth and Security: OAuth, Scopes, and Enterprise Permissions Guide
In brief: MCP apps use one of three auth patterns: OAuth 2.1 with PKCE (mandated by the MCP spec for remote servers, used by Claude, Gemini, modern…
TLS Handshakes and OAuth Flows Are Easier to Learn by Clicking Through Them
There are two security flows every backend developer is supposed to know cold and almost everyone half-remembers: the TLS handshake and the OAuth au…
nixamp 0.17: a room with a door, a ticket and a login
nixamp 0.17: a room with a door, a ticket and a login nixamp 0.17.1 is out. Three things landed in it, and two other sites are built on them the sam…
AI Agent Authentication in 2026: Web Bot Auth, ARD & OAuth
AI agent authentication is not one protocol. It is a stack. An agent may need to discover a tool, prove which workload is running, authenticate an H…
Google Sign-In Works in Debug but Fails in Production on Android? Check This Hidden SHA-1
Google Sign-In worked on my development build. It worked on my preview build. On the version Google Play delivered to real testers, tapping "Sign in…
Best MCP Servers in 2026: One Pick Per Category
Originally published on DevToolHub . The best MCP servers in 2026 aren't just the ones with the most GitHub stars. With the 2026-07-28 spec update —…
How to Compare OAuth vs Native Credentials: Identity Ownership and Session Tradeoffs
Short answer: for a property-management portal, let Google and GitHub prove identity, but keep account ownership, session issuance, and revocation i…
A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert
Keycloak 26.7.1, in a realm where every hand-authored client carries "pkce.code.challenge.method": "S256" and refuses plain . Enable the OAuth Clien…
How to Secure a Staging Environment With Google Cloud IAP
Every staging environment starts out reachable by anyone with the URL, and every team eventually notices that's a problem — a crawler indexes it, a…
Twitch Accepts Invalid Keys and Silently Discards Them — The Hidden Pitfalls of Integration and a 41-Second Recovery
📝 Originally published (in Japanese) at forge.workstyle.tech . Building an AI Avatar Live Streaming System That Runs Unattended When building an AI…
У OpenID-сервера появился второй транспорт: gRPC рядом с HTTP, на тех же маршрутах
redb.Identity получил gRPC-фасад: те же маршруты ядра, тот же реестр клиентов, один токен на оба транспорта. Что внутри, как включить, что померить.…
Patient Portal Login With Convenient Authorization and Explicit Data Consent
Use delegated login for authentication convenience, but record patient consent as a separate, versioned domain event inside the portal. The deciding…
Trusted AI Agent Transactions, Part 2: PingFederate Token Exchange
Using PingFederate as a Transaction Token Service Part 1 separated the user, logical agent, runtime workload, agent execution, and transaction ident…
How I built the Appwrite MCP server (and decided to hide most of its capabilities)
When Anthropic introduced the Model Context Protocol on November 25, 2024, it got everyone's eyes on it, including Christy, who was Appwrite's Engin…
A Practical Guide to Using Auth0 as an Identity Broker for Epic SMART on FHIR
Your team already uses Auth0. Now someone wants to add Epic. On paper, it looks like one more enterprise connection — Epic speaks OAuth 2.0 and Open…
Token Revocation Is Not an Endpoint
I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half…
OAuthSonas: A Tiny OpenID Connect Provider for Playwright E2E Tests
If you've ever wired up end-to-end tests for an app that uses OpenID Connect, you've probably done one of these: stubbed the OIDC library entirely a…
One login to rule them all: centralized auth for internal tools with Caddy
I am lazy. Not in the "I don't want to work" sense 1 , but in the "I refuse to solve the same problem twice" sense. So when I found myself looking a…
Giving an AI assistant read-only access to Microsoft Loop — without breaking permissions
Giving an AI assistant read-only access to Microsoft Loop — without breaking permissions I wanted my AI assistant to read my team's Microsoft Loop p…
What is OpenIddict: the .NET framework developers choose for OAuth 2.0 and OpenID Connect
I've been writing a short series on OpenIddict basics while preparing IdentitySuite's v3.0 release — here's part 1. The .NET framework developers ch…