What’s the safest way to retire unused service accounts and tokens?
I recently reviewed some old side projects and found more abandoned machine credentials than expected: CI personal access tokens, deploy tokens for hosts I no longer use, and…
access tokens
What’s the safest way to retire unused service accounts and tokens?
I recently reviewed some old side projects and found more machine credentials than expected: CI access tokens for projects I abandoned years ago, deploy tokens for hosts I…
Why use long-lived refresh tokens if access tokens expire quickly?
I'm trying to understand the purpose of access tokens and refresh tokens. If access tokens are deliberately short-lived to limit the damage from theft, doesn't using a long-lived…
Why Use Short-Lived Access Tokens If Refresh Tokens Last Much Longer?
I'm trying to understand the security reasoning behind access and refresh tokens. If access tokens are intentionally short-lived to limit the damage from theft, doesn't a long-lived refresh…
Is It Safe to Include Access Tokens in URL Parameters?
I recently discovered something concerning while my mom was using a website to create and send birthday cards. She generated a link to share a project with a…
How can I securely store user access tokens for a web app?
I'm working on a web application that requires securely storing user access tokens and secrets for various external systems. Right now, we're encrypting these tokens at rest using…
Getting Started with Google Auth: Refresh Tokens and Storage
Hey everyone! I've been relying on email and password for authentication in my apps, but now I'm looking to integrate OAuth providers, starting with Google. I've checked out…