AI agent rerouted an insurer's login code to itself
The login request on a major insurer's production site carried two fields that decided where your one-time passcode went: a delivery channel and an…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Paid Media Verification: How SMS OTP Delivery Can Fail Carrier Filtering and Sender Registration
A payment-settled event creates two very different obligations in a media business: send the order receipt, and, when a legal intake flow needs it,…
SMS OTP Delivery Status Explained: Polling for Creator Payout Verification
For creator payout verification, keep OTP creation, expiry, verification, and session issuance on the server. Normalize US and EU phone numbers befo…
JWT Authentication Explained: Theory, Security, and a Complete Node.js & Express Example
JSON Web Tokens (JWT) are one of the most widely used technologies for implementing authentication in modern web applications. You will find JWT in:…
OAuth Email Verification Needs a Proof-Carrying Test
OAuth login is often treated as complete when the provider callback returns a verified email address. Many applications then send a verification mes…
Node.js Email Verification Needs Atomic Tokens
Email verification looks like a small feature: create a token, send a message, and accept the token when the user clicks it. In a real Node.js servi…
REST API Verification Needs an Email Lease
Email verification looks like a simple two-request flow: create an account, send a message, then accept a token. In a production REST API, it is clo…
SMS OTP vs Email OTP: Shift-Deadline Security for HR SaaS Login
TL;DR: For an HR SaaS 2FA login or password-reset flow near a shift boundary, choose SMS OTP or email OTP at runtime according to the employee's ver…
Two-Factor Authentication: How to Observe SMS and Trigger Backup Email
The page says that a marketplace seller cannot open a new property order because the login code never arrived. Support sees an impatient seller. On-…
PostgreSQL Idempotency Keys for Email APIs
Email verification looks like a simple endpoint: accept an address, create a token, send a message, and return 202. In a real REST API, the difficul…
Building Role-Based Authentication with Firebase in a React + Vite SaaS App
Authentication looked straightforward when all I needed was a way for users to sign in. It became more interesting while I was building Loomwing, a…
OAuth Callback Logs Need a Redaction Boundary
OAuth callback handlers are usually reviewed for the right reasons: state validation, PKCE, redirect URI checks, and token exchange errors. Logging…
How to Build a Secure Authentication System
Authentication is one of the most important security components of a modern software application. Websites, mobile applications, online stores, bank…
Custom Password Reset API Selection for Auth Systems Without Webhooks
The most important trade-off is evidence versus coupling: for password recovery and settled-order receipts, choose an email API that lets your appli…
Efficient FastAPI Learning: Avoiding Pitfalls in Async, Database, and Auth Integration
Introduction to FastAPI and Common Pitfalls FastAPI has emerged as a powerhouse for building high-performance web applications, thanks to its async…
Auth Provider Event History vs. Your Audit Log: SOC 2 Evidence
A customer-support system cannot treat an identity provider's event history as the complete record of a risky login. The provider can record authent…
Destructive Identity Operations Explained: Login-Method Removal and Full User Deletion
Short answer: treat login-method removal as a recoverable credential change, but treat full user deletion as an irreversible, observable workflow th…
JWT Explained: How JSON Web Tokens Work
If you've worked with REST APIs, ASP.NET Core, Node.js, React, Next.js, or modern authentication systems, you've probably encountered JWT (JSON Web…
Why I Added a Go Step-Up Risk Score Gate for Password and Email Changes — 3 Lessons
The page that wakes an on-call engineer is rarely the password form itself. It is usually a tenant support ticket followed by a suspicious email-cha…
Phone Verification Debugging for Game Recovery — Correlating Send and Verify Evidence
Short answer: treat a phone verification attempt as one trace that spans send, delivery, and verify, then make every transition auditable before you…
Why WSO2 Identity Server, WSO2 Identity Platform and ThunderID All Exist
Introduction Identity management sounds simple on the surface. A user logs in, the system checks who they are and access is granted. But underneath…
Logistics Account Recovery: 4 Identity Signals for Continuity When Emails Change
Short answer: keep the account anchored to an internal identity record, then treat email as one replaceable recovery factor. For a logistics SaaS, t…
How to Compare OAuth vs Native Credentials: Identity Ownership and Session Tradeoffs
Short answer: for a property-management portal, let Google and GitHub prove identity, but keep account ownership, session issuance, and revocation i…
What are JWT tokens and why your app needs them
What they are, how they work, and why your app needs them You log into an application. A few seconds later, you are in — and the app knows who you a…
Authentication APIs Explained: Template-Owned US/EU Login OTP with SMS and Email Fallback
Short answer: choose an SMS-first authentication messaging API with direct OTP start and verification calls when you own the login templates and nee…
Edtech Identity Linking in Go: Resolve, Inspect, Attach Safely (with Recovery)
The identity linking page says phone-code sign-ins are succeeding, yet returning students are landing in fresh accounts with empty course histories.…
High-Risk Login Controls with Device Fingerprints, Event Reports, and Step-Up Verification
High-risk login controls for a healthtech account must use device fingerprints as signals, preserve event reporting for audit, and require step-up v…
Support Account Defense: Balancing JWKS Caching Against Live Session Introspection
Short answer: verify JWT signatures locally with a cached JWKS, but require live session introspection at the API gateway for refresh-token rotation…
PKCE Downgrade Attack: When the Authorization Server Accepts Both Flows
Two CVEs against the same identity provider, filed six months apart. CVE-2023-48228 and CVE-2024-23647, both against authentik, describe the same fa…
Patient Account Erasure: Coordinating Profile State Update with Session Revocation
Short answer: treat a healthtech account shutdown as two explicit, auditable state transitions: first make the profile ineligible for authentication…