Tag
oauth
- Oct 23, 2026 Refresh Token Rotation and Replay Detection How rotating refresh tokens limit the value of a stolen credential, why a used token presented twice means compromise, and how a grace window keeps honest clients from tripping the alarm. backend systems
- Sep 21, 2026 Scopes Are Strings, Consent Is Policy: Where Access Limits Actually Live Why the scope parameter is only a request, how authorization servers narrow or refuse it, and what incremental authorization costs in state tracking. internet protocols
- Sep 19, 2026 Authorization Code Flow: Why the Redirect Carries a Code and Not a Token How the front channel and back channel split the grant, what exact-match redirect URI registration protects, and where state and mix-up defences sit in the exchange. internet protocols
- Jul 13, 2026 Self-Contained Access Tokens and the Cost of Local Validation What a resource server gains and loses when it validates a signed token locally instead of asking the issuer, and where clock skew and key caching change the answer. internet protocols
- Jul 4, 2026 Constrained Delegation and Token Exchange in OAuth 2.0 How the token exchange grant carries a subject through a chain of services, what scopes and audience restrict, and why impersonation and delegation differ in what the audit log records. security
- Apr 14, 2025 Refresh Token Rotation and Replay Detection in OAuth 2.0 How one-time-use refresh tokens turn a stolen credential into a detectable event, what the rotation chain costs in storage, and where concurrent use breaks the model. internet protocols
- Feb 27, 2025 OAuth 2.0 and the Implicit Grant: Removing a Token from the Browser Why the implicit grant existed, what the browser redirect model made impossible to secure, and how the password and hybrid grants traded a front-channel leak for a different attack surface rather than eliminating it. computing history
- Jun 4, 2024 PKCE: Binding an Authorization Code to the Client That Asked for It How the code verifier and S256 transformation stop intercepted codes from being redeemed, and why the plain transformation is a fallback rather than an equal. internet protocols
- Sep 21, 2023 Client Authentication: Secrets, Assertions, and Certificates What each token endpoint authentication method actually proves, why a shared secret is the weakest of them, and how a signed assertion avoids transmitting one. internet protocols
- Jul 6, 2023 Delegated Authority: What OAuth's Four Roles Actually Separate Why OAuth replaces password sharing with a scoped, revocable token, and how the split between authorization server and resource server makes that possible. internet protocols