I'm developing info.client.com, which is hosted on the client's Apache server. The client's main site, www.client.com, is hosted by a third-party service and embeds info.client.com in an iframe.…
I'm developing info.client.com, which needs to be embedded in an iframe on www.client.com. The main site is hosted by a third-party platform, while the embedded site runs on…
I'm building a web application and need to choose an authentication and authorization approach. I'm comparing signed JWTs, encrypted JWTs (JWEs), and database-backed sessions. Which option is generally…
I'm trying to understand the purpose of access tokens and refresh tokens. If access tokens are deliberately short-lived to limit the damage from theft, doesn't using a long-lived…
I'm building a web application and need to choose an authentication and authorization approach. I'm comparing signed JSON Web Tokens (JWTs), encrypted JSON Web Encryption tokens (JWEs), and…
I'm trying to understand the security reasoning behind access and refresh tokens. If access tokens are intentionally short-lived to limit the damage from theft, doesn't a long-lived refresh…
I'm trying to clarify the relationship between sessions, JWTs, and stateless systems. A session seems to be a period of interaction in which some state is carried between…
I'm working on a system using an Express.js API and a frontend website where users log in with their credentials to interact with the API. My company wants…
I've been using the same authentication method across all my backend projects, but I'm starting to wonder if it's truly secure. My setup involves stateless JWTs stored in…
I've set up JWT authentication on my Application Load Balancer (ALB) and I'm running into issues. Even after configuring it on a different host header and a sub-path,…
User authentication is a crucial part of web development, and I'm interested in the techniques and tools you use for managing it effectively. Do you lean towards established…
I've been really struggling with how to manage authorization when using WebSockets. I have a WebSocket server that needs to communicate with other services on behalf of a…
I'm working on a web app and want to get some feedback on my current architectural choice. For public pages that don't require any user-specific data, like sections…
I've been trying to secure my backend hosted on Elastic Beanstalk so I can send my httpOnly JWT cookies to the frontend. Right now, the frontend is secured…
I recently came across some news about the Application Load Balancer (ALB) supporting client credential flow with JWT verification. I've studied for certifications and know that ALB can…
Hey everyone! I'm currently working on an internal API for my company that needs to receive the username of the employee who is logged into another internal web…
I'm working on an OAuth flow to link user accounts and could use some advice. When a user logs in or registers for the first time, I can…
I've been looking into the differences between JWT (JSON Web Tokens) and session-based authentication methods. I came across an article that discussed the invalidation problem with JWTs, which…
I'm trying to wrap my head around the differences between JWT tokens and HTTP sessions. My understanding is that an HTTP session is the time when a client…
Hey everyone! I'm hosting a Single Page Application (SPA) on AWS and have set it up using the following configurations: my frontend is deployed to an S3 bucket…