Best of Authentication — March 2024
- 1
- 2
Appwrite·2y
Rethinking password security: say goodbye to plaintext passwords
Storing passwords in plaintext poses significant security risks and vulnerabilities. Alternatives to plaintext passwords include password hashing and passwordless authentication. Appwrite provides multiple authentication methods to combat plaintext passwords.
- 3
Community Picks·2y
Next.Js authentication using Lucia and MongoDB
Lucia is a simple and easy-to-use auth library for servers that provides strong database support. It has built-in adapters for various databases and offers full control over user data and session management. This article explains how to set up Lucia with Next.js using MongoDB as the database and provides examples of implementing signup, login, logout, and protected routes.
- 4
- 5
- 6
- 7
- 8
InfoQ·2y
ASP.NET Core Updates in .NET 9 Preview 2: Blazor, OIDC, OAuth and Configuring HTTP.sys
ASP.NET Core in .NET 9 Preview 2 brings updates including Blazor component constructor injection, WebSocket compression for Blazor interactive server components, customizing OAuth and OIDC authorization parameters, and configuring HTTP.sys extended authentication flags.
- 9
Cerbos·2y
Guide to Web3 authorization & authentication
The shift to Web3 involves decentralization and user-centric controls powered by the blockchain. Web3 authentication leverages blockchain technology for secure and user-centric access to DApps. Web3 authorization determines user access through smart contracts and eliminates the need for centralized control. Challenges include scalability, user experience, and private key management.
- 10
- 11
Cloudflare·2y
Protecting APIs with JWT Validation
Cloudflare customers can now protect their APIs from broken authentication attacks by validating incoming JSON Web Tokens (JWTs) with API Gateway's JWT Validation. The release addresses feature requests for supporting the Bearer token format, creating multiple JWKS configs, validating JWTs sent in cookies, and excluding managed endpoints in a JWT validation rule. Broken authentication is a major threat in API security, and JWT validation helps enforce a positive security model for authenticated API users. JWTs provide short-lived sessions and enhanced security compared to other authentication methods. API attacks like missing or broken authentication, expired token reuse, and Broken Function Level Authorization attacks can be prevented with proper authentication and authorization. API Gateway's JWT Validation checks JWT signatures, expiration times, and the presence of authentication tokens to protect against these attacks. Cloudflare Access and custom Cloudflare Workers are other options for JWT validation, but API Gateway provides an easier and more manageable experience. Future releases will expand the capabilities of API Gateway, including generating and enforcing authorization policies and enhancing API management with Cloudflare.
- 12
- 13
- 14
RUBYLAND·2y
Secure code review checklist
A post providing a checklist for secure code review, including static code analysis, test coverage, input validation, dangerous methods, strong parameters, authentication and authorization, data handling, dependencies, business logic, configuration changes, error handling, file uploads, and third-party services.
- 15
Okta Dev·2y
Add Step-up Authentication Using Angular and NestJS
This post demonstrates how to add step-up authentication to an Angular frontend and NestJS backend using the OAuth 2.0 Step Up Authentication Challenge Protocol. It covers setting up the authentication configuration, guarding routes with step-up authentication, and protecting API resources with the challenge. The post also mentions the possibility of ensuring authentication recency in step-up authentication.
- 16
The cost of convenience: preventing password sharing
Password sharing poses significant risks for businesses, including security breaches, data leaks, compliance violations, and loss of intellectual property. To prevent password sharing, businesses can enforce multi-factor authentication, adopt passkeys or passwordless authentication, deploy time-based one-time passwords, enable role or policy-based access control, implement password policies, and promote education and awareness. Technological solutions include authentication systems, passwordless authentication technologies, access management tools, and user and entity behavior analytics. Cultivating a culture of security among developers is also crucial in preventing password sharing.
- 17
- 18
codeHeim·2y
#30 Golang - User Authentication with Gin Gonic & GORM - Part 2
This post discusses the implementation of user authentication with Gin Gonic and GORM in a Golang application. It covers topics like middleware for authorization, handling user session management, and improving app security and user experience.
- 19
