Tag
Application and identity security — JWT validation, token revocation, XML signature, encryption, threat models, and OWASP guidance.
71 posts · page 1 of 4
Explore RFC 8693's specifications for token exchange, delegation, and impersonation, essential for secure identity propagation in modern OAuth 2.0 architectures.
Part 4 · OAuth 2.0 RFCs Every Engineer Should ReadLearn how to securely implement OAuth 2.1 discovery in your client applications, focusing on issuer validation and strict discovery document validation to prevent authorization server attacks.
Part 6 · Authorization Server Metadata (RFC 8414)RFC 8414 defines how authorization servers publish supported authentication methods. This post explores the default client_secret_basic method and its alternatives.
Part 4 · Authorization Server Metadata (RFC 8414)Learn how sender-constrained tokens like DPoP and mTLS strengthen security by binding tokens to specific clients and preventing misuse.
Learn how to implement gRPC interceptors to propagate OAuth2 tokens securely across microservices for improved service-to-service security.
Learn how to apply RFC 8707 resource indicators for precise audience restrictions and secure multi-resource access patterns in OAuth2 flows.
Part 3 · OAuth2 Security PatternsLearn how to implement enterprise SSO with Spring Security SAML, covering service provider configuration and migration paths for Spring Boot applications.
Part 6 · Spring Security Deep Dive SeriesLearn how to build effective identity verification systems for KYC compliance, covering digital identity proofing, document checks, and biometric authentication.
Learn how to implement back-channel logout in OIDC for reliable session termination, covering logout tokens and session management strategies.
Part 3 · OpenID Connect Security SeriesLearn how SAML artifact binding optimizes Single Sign-On performance by minimizing latency and network traffic compared to standard bindings.
Learn how to implement a centralized audit log for identity events using the ELK stack to enhance security monitoring and meet audit compliance requirements.
This guide covers setting up identity-aware load balancing with NGINX and Keycloak, focusing on JWT handling and secure authentication routing.
Learn how to implement OAuth2 Proof-of-Possession (PoP) to secure token transmission using sender-constrained and certificate-bound token strategies.
Learn how to implement graceful key rotation using JWKS to maintain security and availability in your authentication infrastructure.
Part 1 · Security Architecture SeriesLearn how to set up passkey authentication in Keycloak using WebAuthn and FIDO2 protocols to replace traditional passwords with secure, passwordless login methods.
Learn how OAuth2 handles multiple response types like hybrid flow and OIDC, and understand the role of the authorization server in these flows.
Part 3 · OAuth2 & OIDC Mastery SeriesExplore essential authentication patterns for serverless identity in Lambda and cloud functions, including Cognito authorizers and security best practices.
Learn how to build a secure self-service password reset mechanism with Spring Boot and Keycloak, covering required actions and identity management.
Learn how to secure your Spring Boot applications by integrating TOTP-based Multi-Factor Authentication with Google Authenticator for enhanced security.
Learn how to construct a custom authentication provider in Spring Security to handle specific user validation logic and security requirements.
