OAuth Test Tenants Need Email Trust Boundaries
OAuth tests often stop at the redirect. That misses an important part of the trust story: what happens when a user must prove control of an email ad…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
OAuth Email Verification Needs a Proof-Carrying Test
OAuth login is often treated as complete when the provider callback returns a verified email address. Many applications then send a verification mes…
Issuerd: a Keycloak-compatible IAM in Rust — one binary, 3,907 OIDC conformance checks, zero failures
If you've operated Keycloak in production, you know the tax: a JVM that wants gigabytes before it serves a single login, container startup measured…
A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap
A Deactivated User With a Live Token: Reading Concrete CMS CVE-2026-85387 as a Revocation Gap Revocation is the part of identity that nobody tests I…
OAuth Callback Logs Need a Redaction Boundary
OAuth callback handlers are usually reviewed for the right reasons: state validation, PKCE, redirect URI checks, and token exchange errors. Logging…
Don't Ship Dev Keys! Set Up Production-Ready Google OAuth in React
Learn how to integrate production-ready Gmail / Google Sign-In into your applications using Auth0. In this complete, step-by-step tutorial, Layla (S…
Verifiable Data > Claimed Data: What i'm Trying to do with Ori's List
Most of the data we act on is claimed data. Someone tells you a number, shows you a chart, or hands you a PNG, and you decide whether to believe the…
Google Sign-In Works in Debug but Fails in Production on Android? Check This Hidden SHA-1
Google Sign-In worked on my development build. It worked on my preview build. On the version Google Play delivered to real testers, tapping "Sign in…
Best MCP Servers in 2026: One Pick Per Category
Originally published on DevToolHub . The best MCP servers in 2026 aren't just the ones with the most GitHub stars. With the 2026-07-28 spec update —…
How to Compare OAuth vs Native Credentials: Identity Ownership and Session Tradeoffs
Short answer: for a property-management portal, let Google and GitHub prove identity, but keep account ownership, session issuance, and revocation i…
Supercharging DeepSeek Harness: Bringing Claude Pro/Max with One-Click Google/Gmail OAuth Login and Real-Time Quota Tracking
By **grloper * ( GitHub @grloper )* 1. Introduction: The Subscription Dilemma in Modern Agent Frameworks DeepSeek Harness (DSH) has quickly establis…
A provisioned Keycloak client inherits no PKCE pin, and the obvious fix is inert
Keycloak 26.7.1, in a realm where every hand-authored client carries "pkce.code.challenge.method": "S256" and refuses plain . Enable the OAuth Clien…
How to Secure a Staging Environment With Google Cloud IAP
Every staging environment starts out reachable by anyone with the URL, and every team eventually notices that's a problem — a crawler indexes it, a…
How I Handle OAuth2 Token Refresh and Quotas in a Django API Gateway
My first post about Asstgr covered the "what" — a self-hosted gateway that lets you register third-party APIs and call them through one unified inte…
Patient Portal Login With Convenient Authorization and Explicit Data Consent
Use delegated login for authentication convenience, but record patient consent as a separate, versioned domain event inside the portal. The deciding…
Как мы прогоняли свой OpenID-сервер через официальный conformance-suite и что он в нас нашёл
Прогон OIDF conformance-suite по redb.Identity: как настроить сьют, почему кликали вручную, и какие реальные баги он нашёл, включая утечку телефона…
Don't Hand Your Inbox to an Agent
A Reddit thread on connecting Claude Code to a Yahoo Mail account turned into a solid field guide for scoping down what an AI agent is allowed to to…
How I built the Appwrite MCP server (and decided to hide most of its capabilities)
When Anthropic introduced the Model Context Protocol on November 25, 2024, it got everyone's eyes on it, including Christy, who was Appwrite's Engin…
A Practical Guide to Using Auth0 as an Identity Broker for Epic SMART on FHIR
Your team already uses Auth0. Now someone wants to add Epic. On paper, it looks like one more enterprise connection — Epic speaks OAuth 2.0 and Open…
Token Revocation Is Not an Endpoint
I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half…
OAuthSonas: A Tiny OpenID Connect Provider for Playwright E2E Tests
If you've ever wired up end-to-end tests for an app that uses OpenID Connect, you've probably done one of these: stubbed the OIDC library entirely a…
What is OpenIddict: the .NET framework developers choose for OAuth 2.0 and OpenID Connect
I've been writing a short series on OpenIddict basics while preparing IdentitySuite's v3.0 release — here's part 1. The .NET framework developers ch…
How to Test OAuth Recovery Emails Without Exposing Real Inboxes
OAuth recovery emails look harmless until you test them the lazy way. A team sends password reset links or recovery codes into one shared mailbox, c…
OAUTH2.0 In Action — A Guide To Implementing OAUTH In Apps and Websites.
Table of contents What is OAUTH A trip to OAUTH1.0Ville What is OAUTH2.0 Examples of OAUTH Technology OIDC Hands-on Implementation with Microsoft En…
Passwords are not necessary, a Oauth/OIDC approach
Intro It is possible to skip the burden of password management, security, encryption and password rotations. When using OAuth 2.0 with OIDC (OpenID…
Four Bugs Stood Between Me amd "Sign in with Google"
Summary: I had a rough time adding Google login to my app, Kenning. It took me a while to figure out four issues that were causing problems. These i…
Mastering Symfony Security, Passports and Custom Authenticators
Security is the cornerstone of any modern web application, but historically, implementing robust authentication and authorization mechanisms has bee…
Outlook.com Is the Final Boss of 'Just Send an Email'
Every email project starts with a lie: "I'll just test it with SMTP real quick." That was my plan while working on EpicMail . I wanted a boring, rep…
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes)
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes) If you're shipping an Apify Actor that calls a per-user Go…
Supabase's Management API OAuth Endpoint Switches From 201 to 200 on May 26 — Here's What Silently Breaks
On May 26, 2026, the OAuth token exchange endpoint for Supabase's Management API — https://api.supabase.com/v1/oauth/token — will stop returning 201…