Tag: #jwt
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 19 posts
19 posts are tagged #jwt; the most recent was published on 2026-08-15.
Often tagged together: #authentication 12 #oidc 12 #security 12 #oauth2 10 #architecture 7
Most read in the last 90 days:
The Complete Guide to Authentication and Authorization: Ten Misconceptions, Corrected From the Specs ♪ Listenable
OAuth 2.0 is an authorization framework; OIDC is the authentication layer on top of it. This guide corrects the flows that fell out of the recommendations, the illusion of JWT validation, and the real trade-offs of token
2026-08-15 · 25 min read #인증#인가#oauth#oidc#jwtJWT or Sessions, and When — Settling the Authentication Choice by Asking Where the State Lives
The difference between JWT and sessions is not encryption or performance. It is one question: does authentication state live on the server or on the client? From that choice follows the fundamental weakness of JWT, the i
2026-07-26 · 13 min read #web#jwt#session#authentication#securityOpenID Connect Deep Dive — From the Authorization Code Flow to Discovery
A protocol-level dissection of how OIDC stacks an authentication layer on top of OAuth 2.0: the role differences between ID Token, Access Token, and Refresh Token, and the detailed Authorization Code + PKCE flow with rea
2026-06-12 · 14 min read #oidc#oauth2#jwt#sso#securityCustomizing Keycloak Tokens — Protocol Mappers and Claims Design in Practice
A hands-on guide to designing JWT claims with Keycloak Protocol Mappers and Client Scopes. Covers built-in mappers, a custom ProtocolMapper SPI implementation, audience validation pitfalls, token bloat diet strategies, a
2026-06-12 · 15 min read #keycloak#oidc#jwt#sso#securityKeycloak + Spring Security 6 Integration — Resource Server and OAuth2 Client in Practice
A practical guide to integrating Keycloak with Spring Security 6 as an OAuth2 Resource Server and Client. Covers issuer-uri auto-configuration, mapping realm and client roles with JwtAuthenticationConverter, OIDC logout,
2026-06-12 · 11 min read #keycloak#spring-security#oauth2#oidc#jwtOIDC Token Validation at the API Gateway — Istio, Envoy, and Gateway API in Practice
Validate at the edge or in the service? This post covers detailed Envoy jwtauthn filter configuration, the Istio RequestAuthentication plus AuthorizationPolicy combination, JWKS caching and failure modes, audience strate
2026-06-12 · 15 min read #istio#envoy#jwt#oidc#api-gatewayMastering JWT Security — Signature Verification, Key Rotation, and Common Vulnerabilities
We dissect the structure of JWT, JWS, and JWE and cover real-world vulnerabilities such as alg confusion attacks and kid injection, along with their defenses. From JWKS-based key rotation and algorithm selection includin
2026-06-12 · 16 min read #jwt#security#oidc#keycloak#cryptographyKeycloak Integration Hands-On — Run It with Docker, Configure Realm/Client, Wire Up Spring Boot and Next.js (2025 Hands-On Guide) ♪ Listenable
Don't build authentication yourself — use Keycloak. This is a follow-along hands-on: run Keycloak 26 with Docker, configure Realm/Client/User/Role, poke the OIDC endpoints with curl, and integrate a Spring Boot Resource
2026-05-14 · 23 min read #keycloak#oidc#oauth2#authentication#authorizationFrontend Security 2025 — XSS, CSRF, CSP, Trusted Types, JWT, OAuth, PKCE, Passkeys, Supply Chain, SRI (S6 E9)
XSS still tops every CVE report. But 2024–2025 shipped real tools to defeat it: Trusted Types, CSP v3 with strict-dynamic, Sanitizer API. Passkeys replaced passwords for serious products. Supply-chain attacks made SRI +
2026-04-15 · 6 min read #frontend#security#xss#csrf#cspOAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)
OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal
2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorizationOAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey
Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se
2026-03-25 · 22 min read #oauth2#authentication#jwt#session#ssoOAuth2 & JWT Complete Guide: Everything About Authentication and Authorization for Developers ♪ Listenable
Everything about OAuth2 and JWT with practical code! Authorization Code/PKCE/Client Credentials flows, JWT structure and signature verification, Access/Refresh Token strategies, Session vs Token comparison, OIDC, securit
2026-03-23 · 23 min read #oauth2#jwt#authentication#authorization#securitySpring Boot Authentication Practical Guide — Session, JWT, SecurityContext, Cookie-Based Auth Complete Mastery
Master how to implement session and JWT-based authentication in Spring Boot, from SecurityFilterChain and custom filters to SecurityContext and cookie configuration, with practical code examples.
2026-03-08 · 14 min read #architecture#authentication#spring-boot#jwt#cookieSSO Cookie/JWT Authentication System Complete Guide — Framework-Specific Practical Series Index
An overview of the complete flow of SSO, cookie, and JWT-based authentication systems, with a guide to the practical implementation series for Spring Boot, Django, React, and Next.js frameworks.
2026-03-08 · 15 min read #architecture#authentication#sso#jwt#cookieSSO Integration Practical Guide - OIDC/OAuth2 + Cookie/JWT Hybrid Architecture, Token Rotation Complete Mastery ♪ Listenable
Complete mastery of designing and implementing SSO with OIDC/OAuth2 and cookie/JWT hybrid architecture, covering token rotation, refresh strategies, and multi-service authentication with practical code.
2026-03-08 · 20 min read #architecture#authentication#sso#oidc#oauth2Next.js App Router Authentication Practical Guide - Middleware, Server Action, HttpOnly Cookie, SSR Auth Complete Mastery ♪ Listenable
Complete mastery of authentication implementation using middleware, Server Actions, and Route Handlers in Next.js App Router, covering HttpOnly cookies and SSR authentication patterns with practical code.
2026-03-08 · 25 min read #architecture#authentication#nextjs#jwt#cookieReact SPA Authentication Practical Guide — Cookie vs Storage, Axios Interceptors, XSS/CSRF Defense Complete Mastery ♪ Listenable
Master everything about managing authentication state in React SPAs, from comparing cookies, localStorage, and in-memory storage to Axios interceptors, XSS/CSRF defense, with practical code examples.
2026-03-08 · 20 min read #architecture#authentication#react#jwt#cookieDjango Authentication Practical Guide - Sessions, DRF + SimpleJWT, Middleware, Cookie-based Auth Complete Mastery
Complete mastery of session authentication and DRF SimpleJWT-based JWT authentication in Django, covering middleware, request.user, and cookie configuration with practical code.
2026-03-08 · 18 min read #architecture#authentication#django#jwt#cookieOAuth 2.0 Mastery — Everything About Authentication and Authorization
From the inner workings of OAuth 2.0 to Authorization Code, PKCE, Refresh Tokens, and OpenID Connect. Why does a single Google login button require such a complex protocol? We fully dissect it with code and sequence diag
2026-03-02 · 7 min read #architecture#oauth2#security#authentication#authorization