That bcrypt.hash(password, 10) You Copy-Pasted Might Not Be as Secure as You Think
Almost every auth tutorial, including some of my own examples in earlier posts, uses bcrypt.hash(password, 10) without much explanation of what that…
Programming
⚑ Report a ProblemLatest Programming news from Tech News
All topics
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
rust
security
showdev
testing
tutorial
typescript
webdev
Consolidating authentication and authorization into one platform shared by all our products
Conclusion ELN ID is an in-house project run by EarthLink Network as a company, developed by a team of one human owner with AI doing the implementat…
[Перевод] Жизненный цикл токена API: от выпуска до отзыва
Токены (tokens) API часто расцениваются как незначительные детали реализации. Пользователь входит в систему, сервер создает токен, браузер сохраняет…
NextAuth / Auth.js Database Schema Explained
The short version NextAuth (now Auth.js) creates 4 tables in your database: users , accounts , sessions , and verification_tokens . The users and ac…
Next.js 15 Middleware: Auth, Rate Limiting & Edge Guide
Middleware is the most underused primitive in Next.js. Teams write one middleware for auth, ship it, and never touch it again. Meanwhile, they bolt…
Consent Revocation for GDPR Account Deletion: Go Runtime Access Gates
When a developer-tools user withdraws consent, the dangerous assumption is that deleting a row or changing a settings screen ends access immediately…
A Second Check Is a Second Source of Truth
Signup on a site I run asked people to prove they owned their email address, and then asked them again. First a six-digit code, emailed and typed ba…
Как защитить Manticore Search с помощью встроенной аутентификации и авторизации
Поиск нередко считают просто инфраструктурой. Но в продакшене он фактически работает как API приложения: принимает пользовательский т…
[Перевод] Книга аутентификации
Это моя личная книга по аутентификации. Она представляет собой сборник руководств, рекомендаций и примеров по внедрению аутентификации в веб-приложе…
An identity provider told us who you were, and we believed it
Single sign-on has a quiet premise: when a user arrives from an identity provider, that provider has already vouched for them, so you can skip the p…
The SSO tax, in dollars: what SAML actually costs at Auth0, WorkOS, and Clerk
We wrote once about the feature tax : the trick of charging you to flip a boolean that's already written, on infrastructure that's already running.…
Our service discovery caught its own failure and switched itself off
We had a three-replica cluster that kept disagreeing with itself. Background jobs ran two and three times over. The answer wasn't in the logs; it wa…
Your OTP regex assumes six digits. Supabase magic links don't.
Sign-in worked flawlessly in dev. Then a real user pasted a real code and got "invalid format" — before the code ever reached Supabase. The credenti…
Deploying Ory Kratos Open-Source Identity and User Management System on Ubuntu 24.04
Ory Kratos is an open-source, API-first identity and user management system handling registration, login, recovery, verification, and session manage…
How the SAL claim handshake binds humans to agents without key custody
One of the easiest mistakes in agent identity design is to collapse ownership and key custody into the same thing. If a human owns an agent, it can…
Test Clerk auth lifecycle flows without production users
Most auth bugs do not come from the login button. They show up after login: a user is created in Clerk but not in your app database a session expire…
How to Send Auth Codes via WhatsApp in Your App With Kinde
Your users are in San Francisco, Jakarta, São Paulo, and Sydney. They have WhatsApp open all day. They check it before they check their SMS inbox. W…
Why SMS Auth Is Quietly Failing Your Users (And How to Fix It With WhatsApp)
Here is something most developers shipping SMS OTP in 2026 do not want to sit with: the channel they are trusting to verify their users is failing r…
Authorization at Scale: Access Levels, Roles, and Compact Decisions
Authentication answers "who are you?" Authorization answers the harder question: "are you allowed to do this?" By the time a request reaches this st…
Multi-tenant auth and routing in Kubernetes
In the first four chapters of this series I've talked about what the Auth Gateway decides. This chapter is about who it decides for. We run a multi-…
Endpoint classification: OPEN, AUTHENTICATED, ACCESS_CONTROLLED
In Chapter 3 the controller branched on something called the "endpoint type": switch endpointType ( perms ) { case "OPEN" : ... case "AUTHENTICATED"…
Inside the Auth Service: From Token Validator to Policy Decision Point
Most auth services start simple — verify the token, return 200 or 401. Then requirements accumulate. Tenant isolation. Service accounts. Token revoc…
Why we built an Auth Gateway instead of putting auth in every service
If you've been on a platform team long enough, you've probably watched this slow-motion failure: You ship an auth library. Three services adopt it.…
NGINX auth_request: the small primitive that changed everything
In Chapter 1 I claimed our entire Auth Gateway is built on top of one NGINX directive: auth_request . This chapter is a deep dive into how that dire…