Engineering
The Composability Test: Five Questions Before Adding a Feature
Arguments about scope are hard to win because both sides are reasonable.
Latest
Engineering
The Art of Load Testing: Why Most Performance Tests Fail Before They Start
Most teams load test a week before launch.
Engineering
The 10 Architectural Decisions That Define Every Identity Platform
Every identity platform is the sum of about ten decisions, most of which get made in the first six months and none of which get revisited cheaply. They're not implementation details. They're the load-bearing choices that determine what the system can do five years later — and more importantly, what
Engineering
Step-Up Authentication: The Right Way to Handle Sensitive Operations
A bank I worked with had a rule: transfers over £10,000 required a second factor.
Engineering
Signed, Encrypted, or Both: A Decision Guide for SAML
Somewhere in your SAML integration documentation there is probably a sentence like "assertions must be signed and encrypted." Somewhere in a customer's security questionnaire there is a question asking whether you support assertion encryption, and the only commercially viable answer is yes.
Engineering
Seven Identity Bugs Every Team Eventually Ships
Identity bugs have a distinctive personality, and it's an unpleasant one.
Engineering
Sessions, Tokens, and Cookies: Which One Is Actually Holding Your Login Together
A support ticket, verbatim, from a team I worked with: "User logs out of the admin app, gets redirected to the login page, and is immediately logged back in without entering anything. Only happens on admin.example.com, not app.example.com. Only in Chrome."
Engineering
SAML vs OAuth vs OIDC: What Each One Is Actually For
These three get compared constantly, usually in a table that lists which one uses XML and which one uses JSON. That comparison is technically accurate and almost useless, because it implies the three are alternatives competing for the same job.
Engineering
SAML Certificate Rotation Without an Outage
At 08:47 on a Monday, 4,000 people at one of your customers cannot log in. Every SSO attempt fails with a signature validation error.
Engineering
Public Certificate vs. Public Key: They Are Not the Same Thing
These two terms get used interchangeably constantly, including by people who work with them daily, and the conflation causes real confusion when it actually matters — like debugging a TLS handshake failure or reviewing a SAML integration. Here's the distinction, and why it exists at all.
Engineering
Password Breaches Only Matter If You Have Passwords
Every year, another billion credentials leak.
Engineering
Passkey Account Recovery Is the Whole Problem
Here is a claim you will find on nearly every passkey landing page, including some very good ones: passkeys are phishing-resistant, unphishable, unreusable, and not vulnerable to credential stuffing. All of that is true.