How to secure a Spring Security client application with OIDC (using pac4j)
If you already have Spring Security in your application, with hasRole rules, @PreAuthorize on services and code reading SecurityContextHolder and yo…
Open Source
⚑ Report a ProblemLatest Open Source news from Tech News
All topics
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
npm trusted publishing finally covers dist-tags, if you ask nicely
Picture the npm maintainer who did the hard work: moved publishing to OIDC, deleted the automation token from the password manager, celebrated with…
Introducing IdentiFlows.dev: A Visual Reference for Identity Flows
Every developer who has played with OAuth 2.0 or OpenID Connect knows this moment: you need to double-check the exact sequence of a flow, and the di…
Architecture on the Chopping Block: The OIDC Dependency We Didn’t Know We Had
Before joining Cloud.ru , I worked at a company that built and deployed enterprise IT solutions for large customers. Its main product was a packaged…
redb 4.0: XML-маршруты, ленивые ссылки, уникальные ключи и WS-Trust в одном мажоре
Мажор всей экосистемы: что появилось в redb.Core, redb.Route, redb.Tsak и redb.Identity , что закрыто по безопасности и что ломает обновление. Много…
Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern
Docker has switched on OpenID Connect authentication between GitHub Actions and Docker Hub, letting a workflow exchange a signed per-run identity to…
Our login hung for exactly 10 seconds. Our own security headers did it.
For about a week, returning users who opened our portal watched the word "Loading…" sit on the screen for ten seconds before the login page appeared…
Anthropic swaps per-developer Claude Code secrets for an OIDC gateway
Every laptop with Claude Code on it tends to collect long-lived secrets like lint. A cloud key here, a service credential there, an API token in a d…
OAUTH2.0 In Action — A Guide To Implementing OAUTH In Apps and Websites.
Table of contents What is OAUTH A trip to OAUTH1.0Ville What is OAUTH2.0 Examples of OAUTH Technology OIDC Hands-on Implementation with Microsoft En…
Azure DevOps issuer in WIF service connections heads for July 2027 retirement
About a year of lead time, then a forced move. Microsoft announced on June 22 that the Azure DevOps issuer used in workload identity federation (WIF…
Understanding OIDC Authentication Flow Visually
OpenID Connect is an identity layer built on top of OAuth 2.0 that provides a standardized way for apps to verify a user's identity and obtain basic…
SSO Is More Than "Log In Once"
A practical look at identity, sessions, OAuth 2.0, OpenID Connect, and tenant isolation. Single Sign-On is often summarized as "log in once and acce…
Логин через Telegram по-новому: разбираем OIDC-флоу oauth.telegram.org и собираем его на Python
Telegram теперь полноценный OpenID-провайдер: oauth.telegram.org, JWKS, JWT, claims. Туториалы на GitHub при этом массово показывают старый виджет с…
JWT verification in production: an 8-check field guide
A correct JWT verifier does eight things. Most production verifiers I have read do four or five of them. The other three or four get skipped because…
Three JWT bugs that ship to prod silently — and the 5-line CI test that catches them
Your auth tests pass. Your token verification works. Then your identity provider rotates a key at 02:47, your service hasn't refreshed its JWKS cach…