9 min readBackendFeatured
JWT Expiration, Rotation, and Revocation: A Lifecycle Guide
Learn how to manage JWT expiration, rotation, and revocation effectively to secure your application's token lifecycle.
All tags
Tag
Api Security
Read 19 articles on Api Security by Ashish Srivastava — practical guides covering implementation patterns, security, and production lessons.
19 posts
10 min readtechnicalFeatured
Understanding OAuth2 Incremental Authorization
Learn how incremental authorization enhances the OAuth2 flow by requesting scopes progressively, optimizing scope management and consent UX.
8 min readtechnicalFeatured
Securing OAuth2 Bearer Token Usage: RFC 6750 Best Practices
Learn how to properly implement OAuth2 bearer tokens according to RFC 6750, including secure header usage and effective error handling strategies.
Part 2 · OAuth2 & OIDC Mastery Series
9 min readBackendFeatured
Understanding JWKS: Rotating Signing Keys Gracefully
Learn how to implement graceful key rotation using JWKS to maintain security and availability in your authentication infrastructure.
Part 1 · Security Architecture Series
8 min readBackendFeatured
OAuth2 Dynamic Client Registration for Multi-Tenant SaaS
Explore how OAuth2 Dynamic Client Registration enables automated client provisioning for multi-tenant SaaS platforms, ensuring scalable identity management.
9 min readBackendFeatured
OAuth2 Client Authentication Methods: client_secret_basic, private_key_jwt, and More
Explore essential OAuth2 client authentication strategies like client_secret_basic and private_key_jwt for securing API access.
9 min readBackendFeatured
Building an Identity-Aware API Gateway with Kong and OIDC
Learn how to implement effective identity-aware authentication in your API gateway using Kong, OIDC, and JWT plugins.
10 min readBackendFeatured
Building a Developer Identity Portal with Spring Boot and Keycloak
Learn how to build a self-service identity portal leveraging Spring Boot and Keycloak for secure identity management and API access control.
8 min readBackendFeatured
GraphQL Security: Authentication and Authorization Patterns
Learn essential patterns for securing GraphQL APIs, covering authentication flows, authorization strategies, and managing query complexity to prevent abuse.
8 min readTechnicalFeatured
Spring Security OAuth2 Resource Server: Securing APIs
A practical guide to securing APIs using Spring Security OAuth2, covering JWT decoders and token validation strategies.
Part 5 · Spring Security Deep Dive Series
10 min readBackendFeatured
Spring Security and GraphQL: Securing GraphQL APIs
Explore essential strategies for securing GraphQL endpoints with Spring Security, including effective authorization patterns and rate limiting techniques.
Part 1 · Secure Backend Architecture Series
9 min readtechnicalFeatured
API Key Management Best Practices: Design, Distribution, and Rotation
Learn essential strategies for managing API keys, including secure design principles, distribution workflows, and automated rotation techniques.
Part 9 · Machine Identity & DevSecOps Series
9 min readDevelopmentFeatured
AWS WAF and Shield: Protecting Applications from Layer 7 Attacks
A technical look at leveraging AWS WAF and Shield to secure web applications from Layer 7 threats and DDoS attacks.
Part 15 · AWS IAM & Cloud Security Series
10 min readSecurityFeatured
API Security Best Practices: Rate Limiting, JWT, and OAuth2 Scopes
Learn how to secure your APIs using rate limiting, JSON Web Tokens, and proper OAuth2 scope management to prevent unauthorized access.
Part 6 · Zero Trust & Modern Security Architecture Series
11 min readDevelopmentFeatured
Keycloak Client Scopes and Protocol Mappers Explained
Understand how to configure Keycloak client scopes and protocol mappers to customize tokens and manage claims effectively.
Part 10 · Keycloak Masterclass Series
8 min readBackendFeatured
OAuth 2.0 Fundamentals: Grant Types Explained Simply
Understand the core OAuth 2.0 grant types like authorization code, client credentials, and PKCE to implement secure authentication flows effectively.
Part 1 · OAuth 2.0 Deep Dive Series
9 min readDevelopmentFeatured
OAuth 2.1: What's Changing and How to Prepare
Learn how to prepare for OAuth 2.1 with mandatory PKCE, key deprecations, and essential security updates for a secure transition.
Part 7 · OAuth 2.0 Technical Series
8 min readTechnicalFeatured
OAuth 2.0 vs JWT: Understanding the Relationship
Clarify how OAuth 2.0 protocols interact with JSON Web Tokens. Learn about opaque tokens, format selection strategies, and essential best practices for secure implementation.
Part 6 · OAuth 2.0 Series
10 min readSecurityFeatured
OAuth 2.0 Token Introspection & Revocation Strategies
Explore production-grade approaches to managing token lifecycles, implementing introspection endpoints, and enforcing revocation policies in secure environments.
Part 4 · OAuth 2.0 Deep Dive Series