Engineering
Most explanations of XML Signature Wrapping stop at the summary: "the attacker moves the signed element somewhere else and the parser reads the wrong one." That sentence is accurate and completely useless. It doesn't tell you what your code is doing wrong, and it doesn't tell you what a fix looks li
Engineering
Your ACS endpoint is a URL on the public internet that accepts a POST with a Base64-encoded XML document and, if it likes what it reads, logs someone in.
Engineering
I want to be clear about where I'm standing before I start listing problems: passkeys are the most significant improvement in consumer authentication in twenty years. Phishing resistance as a structural property rather than a training exercise. No shared secret to breach. No reuse across sites. If y
Engineering
The first client credentials integration takes about five minutes.
Engineering
Login is a request-response problem. The user shows up, proves something, and gets a credential. It either works or it visibly doesn't.
Engineering
At 09:12 on a Tuesday, login p99 went from 90 milliseconds to just over four seconds and stayed there for twenty-six minutes.
Engineering
If you open up the architecture of Auth0, Okta, Keycloak, Ping, and any serious in-house identity platform built in the last decade, something slightly uncomfortable becomes obvious: they all look alike. Not similar in the way that all web apps look alike. Similar in the specific, structural way tha
Engineering
Nobody sets out to build a distributed system. What people build is a service with a database, and then they solve six problems in a row, each of which has an obvious solution, and eighteen months later they are running a distributed system with none of the design properties of one.
Engineering
Nobody sets out to run Kafka because they wanted to run Kafka.
Engineering
Picking an IAM platform is not a decision you get to revisit cheaply. Once user identities, sessions, and every downstream integration are wired against a specific provider, migrating away is closer to a re-platforming project than a configuration change. That's exactly why this is worth evaluating
Engineering
OAuth 2.0 is old enough to drive. The ecosystem is mature, the libraries are good, and every security review in the industry prefers it.
Engineering
Over eleven days, an attacker tried 4.2 million passwords against 380,000 accounts at a company I'll leave unnamed. They got into 1,900 of them. The pattern was textbook credential stuffing: one attempt per account, rotating residential proxies, human-plausible timing, user agents drawn from a reali