Tag
Application and identity security — JWT validation, token revocation, XML signature, encryption, threat models, and OWASP guidance.
202 posts · page 9 of 11
Learn how DPoP enhances OAuth2 security by binding access tokens to specific clients, preventing token theft and replay attacks.
Part 3 · OAuth 2.0 SecurityExplore essential OAuth2 client authentication strategies like client_secret_basic and private_key_jwt for securing API access.
Part 1 · OAuth 2.0 SecurityExplore registered and custom JWT claims, learn token validation techniques, and apply best practices for secure authentication.
Part 9 · OAuth 2.0 RFCs Every Engineer Should ReadExplore how OAuth 2.0 Rich Authorization Requests (RAR) enable fine-grained authorization through RFC 9396.
Part 4 · OAuth 2.0 & OIDC MasteryExplore the critical differences between workforce identity and customer identity management, focusing on implementation strategies for B2B and B2C scenarios.
Part 6 · Identity Platform ArchitectureExplore essential identity architecture patterns for micro-frontends and multi-platform setups, including BFF, cross-platform SSO, and unified identity solutions.
Part 4 · Frontend Identity IntegrationLearn how to automate access certification processes with Keycloak and Spring Boot for better compliance and identity governance.
Learn how to build dynamic authorization logic with ABAC, Spring Security, OPA, and Rego policies for fine-grained access control in Java applications.
Learn how Pushed Authorization Requests (PAR) defined in RFC 9126 improve OAuth 2.0 security and mitigate the risk of authorization code interception.
Part 2 · OAuth 2.0 SecurityExplore how RFC 8693 standardizes token exchange for delegation and impersonation scenarios in Keycloak environments.
Part 8 · OAuth 2.0 RFCs Every Engineer Should ReadExplore real-world insights on designing a centralized identity platform, including IAM evaluation techniques and strategic architecture decisions.
Part 1 · Identity Platform ArchitectureCompare Role-Based Access Control and Attribute-Based Access Control models to determine the best authorization strategy for your infrastructure using OPA and XACML.
Explore essential gRPC security strategies covering TLS configuration, mTLS implementation, token propagation techniques, and effective interceptor patterns.
Learn essential patterns for securing GraphQL APIs, covering authentication flows, authorization strategies, and managing query complexity to prevent abuse.
Learn to implement distributed tracing and capture security metrics in Spring applications using OpenTelemetry for enhanced observability.
Part 14 · Spring Security Deep Dive SeriesA walkthrough of testing strategies for Spring Security, covering MockMvc assertions, user mocking with @WithMockUser, and OAuth2 integration testing patterns.
Part 9 · Spring Security Deep Dive SeriesThis guide covers implementing a custom UserDetailsService in Spring Security, focusing on user loading mechanisms and caching strategies for enhanced security.
Part 16 · Spring Security Deep Dive SeriesLearn how to implement envelope encryption and manage key policies in AWS KMS to secure your data infrastructure effectively.
Part 12 · AWS IAM & Cloud Security SeriesLearn how certificate-based authentication leverages X.509 standards to establish device trust and verify posture for secure access in modern networks.
Part 9 · Passwordless & Next-Gen Authentication SeriesExplore how to implement magic link authentication securely. We cover the mechanics of passwordless login, security best practices, and user experience benefits.
Part 5 · Passwordless & Next-Gen Authentication Series
