Engineering

Engineering

Authentication State vs. Session State: The Distinction That Explains Half Your Logout Bugs

Here's a bug report that should feel familiar:

Engineering

Authentication Isn't Hard. Authentication Done Correctly Is.

Every developer can build a login page. Give a junior engineer a weekend and a copy of bcrypt and they'll produce something that works: a form, a database check, a session cookie. It'll even be secure enough for a side project. The gap between that and a login system that survives enterprise custome

Engineering

Authentication Is Not Authorization

Every engineer can recite the distinction. Authentication is who you are; authorization is what you're allowed to do. It takes about four seconds to explain and everyone nods.

Engineering

Authentication Is Infrastructure. Stop Treating It Like a Feature.

Authentication is one of the few parts of a software system that becomes more expensive the longer you own it. Unlike business features, it never reaches a point where it's "done." New attack vectors emerge. New standards appear. Enterprise customers demand federation. Compliance teams ask for stron

Engineering

Auditing Agent Actions: Who Did What, On Whose Behalf?

The incident review started well. Someone had pulled 4,200 customer records out of the analytics API in eleven minutes on a Tuesday afternoon, and we had beautiful logs — every read, timestamped to the millisecond, with the record ID, the fields returned, the source IP, and the actor.

Engineering

Attestation: The WebAuthn Feature You Probably Shouldn't Use

There is a moment in most WebAuthn implementations when someone reads the spec, discovers attestation, and gets excited. It sounds like exactly what a security-conscious team wants: cryptographic proof of what kind of authenticator the user registered. Not a claim, not a user-agent string — a signat

Engineering

Approving a Login on Your Phone for a Smart TV Is an OAuth Flow

You buy a television. You open the YouTube app. It shows you a URL and eight characters — BQDJ-MXWP — and asks you to type them into your phone.

Engineering

Agent Authentication: Why "Just Another OAuth Client" Stops Working

If you already understand OAuth clients, you already have most of what you need to understand agent authentication — which is both reassuring and slightly misleading. Reassuring, because an AI agent calling an API really is, structurally, a client requesting a token. Misleading, because the moment y

Engineering

Adaptive MFA: Security Should Follow Risk, Not Rules

There is a specific failure that no security architecture diagram contains.

Engineering

Account Lockout Is a Denial-of-Service Vector

Lock the account after five failed attempts. It's in the hardening guide, the audit checklist, the framework, and the default configuration of nearly every directory product shipped in the last thirty years. Nobody defends it because nobody attacks it.

Identity & Access Management

The Broken Promise of Enterprise IAM: Why We Built ClavionX

Every authentication failure is a broken promise. Here is why identity infrastructure is so hard to get right — and what we built to fix it.