🌱Identity & Access
Who is this user, and what are they allowed to do? The moment you hand that question to an identity provider, you stop writing password code and start writing protocol code - OAuth 2.0, OpenID Connect, tokens, federation. The mistakes here are rarely cryptographic; they're about which token means what, and trusting an assertion you never validated.
Federation & login flows
Principles & traps
Linked from
- 🌿 An access token is not proof of identity
You finish an OAuth/OIDC login, you're holding an access token, and you need the user's email…
- 🌿 The OIDC authorization-code flow with PKCE
The moment you outsource who is this user? to PingFederate, Auth0, Okta, or any OpenID Connect…
- 🌳 This is a garden, not a blog.
Welcome to my garden a second brain I tend in the open. A blog ships a post and walks away. A…