Token Revocation Is Not an Endpoint
I recently wrote a sentence I need to correct: “DPoP stops replay. The gap most teams miss is revocation lag once the token walked.” The second half p…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
career
claude
cybersecurity
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
OAuthSonas: A Tiny OpenID Connect Provider for Playwright E2E Tests
If you've ever wired up end-to-end tests for an app that uses OpenID Connect, you've probably done one of these: stubbed the OIDC library entirely and…
What is OpenIddict: the .NET framework developers choose for OAuth 2.0 and OpenID Connect
I've been writing a short series on OpenIddict basics while preparing IdentitySuite's v3.0 release — here's part 1. The .NET framework developers choo…
How to Test OAuth Recovery Emails Without Exposing Real Inboxes
OAuth recovery emails look harmless until you test them the lazy way. A team sends password reset links or recovery codes into one shared mailbox, con…
OAUTH2.0 In Action — A Guide To Implementing OAUTH In Apps and Websites.
Table of contents What is OAUTH A trip to OAUTH1.0Ville What is OAUTH2.0 Examples of OAUTH Technology OIDC Hands-on Implementation with Microsoft Entr…
Passwords are not necessary, a Oauth/OIDC approach
Intro It is possible to skip the burden of password management, security, encryption and password rotations. When using OAuth 2.0 with OIDC (OpenID Co…
Four Bugs Stood Between Me amd "Sign in with Google"
Summary: I had a rough time adding Google login to my app, Kenning. It took me a while to figure out four issues that were causing problems. These iss…
Mastering Symfony Security, Passports and Custom Authenticators
Security is the cornerstone of any modern web application, but historically, implementing robust authentication and authorization mechanisms has been …
Outlook.com Is the Final Boss of 'Just Send an Email'
Every email project starts with a lie: "I'll just test it with SMTP real quick." That was my plan while working on EpicMail . I wanted a boring, repea…
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes)
How to set up refresh-token-only OAuth for a multi-tenant Apify Actor (Gmail, 10 minutes) If you're shipping an Apify Actor that calls a per-user Goog…
Supabase's Management API OAuth Endpoint Switches From 201 to 200 on May 26 — Here's What Silently Breaks
On May 26, 2026, the OAuth token exchange endpoint for Supabase's Management API — https://api.supabase.com/v1/oauth/token — will stop returning 201 C…
Salesforce ECA Security Compliance for AppExchange ISVs: A Technical Breakdown of the Four OAuth Controls
If you received Salesforce’s mandatory security email in late April 2026 and immediately started questioning which of the four OAuth controls actually…
Why your MCP server should serve OAuth Protected Resource Metadata — AuthKit + RFC 9728
The problem: too many clients, too few discovery hooks We expose Supabase Edge Functions as MCP (Model Context Protocol) servers. The clients that hit…