Blogged: Use client assertions in OpenID Connect and ASP.NET Core
https://damienbod.com/2025/02/24/use-client-assertions-in-openid-connect-and-asp-net-core/

Blogged: Use client assertions in OpenID Connect and ASP.NET Core
https://damienbod.com/2025/02/24/use-client-assertions-in-openid-connect-and-asp-net-core/
"With admin access to those accounts, you can get into many of the services they used Google's #OAuth to log into, like Slack, ChatGPT, Zoom, & HR systems. Ayrey writes that he bought a defunct startup domain & got access to each of those through Google account sign-ins. He ended up with tax documents, job interview details, & direct messages, among other sensitive materials." https://arstechnica.com/security/2025/01/startup-necromancy-dead-google-apps-domains-can-be-compromised-by-new-owners/
I'm presenting at the Wellington Python New Zealand meetup on Thursday evening, so if you're in town come along and cheer.
The subject is integrating #OAuth into a #Django project : what OAuth is and how it works; a good approach to integrating it into a Django project ; and what benefits it brings.
Although the talk with be Django-centric I hope those attending will be able to contribute their experience of using OAuth in #Flask, #FastAPI etc.
Sign up is here : https://www.meetup.com/pythonnz-wellington/events/304242570/
I am not entirely the same opinion, but I don't know the ultimatiave solution either.
»API Keys vs OAuth - Discover Best Practices to Secure your API's:
Securing your API may sound complicated, but there are some basic things you can consider when setting up your API in a more secure way than just exposing it wide open to the public. Authenticating a consumer is a first step towards…«
https://blog.axway.com/learning-center/digital-security/keys-oauth/api-keys-oauth
Trying to figure out how to use #OAuth and #OpenID in #OrchardCore to provide user authentication for an #Angular app (as opposed to just authenticating the whole app) but for some reason I'm finding the whole topic infuriatingly confusing.
How to Design a Secure Web API: Best Practices
Designing a secure Web API is essential to protect sensitive data, prevent unauthorized access, and ensure safe interactions with your application. Whether you’re developing a RESTful API or GraphQL API, implementing security measures is key to maintaining the integrity and safety of your system.
Blogged: Customizing a single client sign-in using parameters in Duende IdentityServer
#Fedi, looking for people with experience in #accessible software.
I have a friend with serious vision issues. Not blind, but can't easily read text that isn't 6+ inches high, and his vision is degrading. He is looking for a way to deal with email -- he's a writer -- because he says Gmail is now a nightmare to use even with a screen reader.
Preferred solution would be a mail program / #MUA that runs on Windows and supports #OAUTH authentication, so he can continue to use his Gmail address.
What's the MUA with the best #accessibility on Windows? Thunderbird brags about its support for screen readers and assistive technologies, so I had him try it, and he says it's almost as bad as Gmail - flashing colours, animating controls. I haven't personally touched Thunderbird in many years, so it was a surprise to me.
I use a text/console mail flow that relies on a local MTA, so nothing I use is of any use in this.
Thanks, appreciate any pointers.
Wrote an article about using siege and showing how to test your web API's read and write performance, Bearer tokens, custom headers and JSON payloads. It's all there.
https://skybert.net/craftsmanship/the-world-is-mean-so-your-load-tests-must-be-meaner/
How to check for OAuth apps with specific Graph permissions assigned
https://jeffreyappel.nl/how-to-check-for-oauth-apps-with-specific-graph-permissions-assigned/
Blogged: ASP.NET Core delegated OAuth Token Exchange access token management
Your app shouldn't need full Google access to check calendar availability.
WorkOS AuthKit now supports custom OAuth scopes for Google & Microsoft integrations
Blogged: Multiple client sign-in customizations using Duende identity provider
A little rant about e-mail authentication:
https://francisaugusto.com/2025/Email-quo-vadis-or-where-is-oidc-for-everyone/
@mwl I'd love your comment on this!
#Development #Explainers
What’s OAuth2 anyway? · How the most popular authorization framework works https://ilo.im/1623dq
_____
#Authorization #Authentication #Credentials #OAuth #OAuth2 #ClientServer #Security #WebDev #Frontend #Backend
Despite being central to their security, many orgs struggle to securely implement #OAuth. Our new post walks through common issues & how to prevent them, along with a useful checklist! Read it today & ensure your org is secure: https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html
Nieuwe beveiligingsfout in populaire reisdienst: miljoenen mogelijk getroffen https://www.trendingtech.news/trending-news/2025/01/51706/nieuwe-beveiligingsfout-in-populaire-reisdienst-miljoenen-mogelijk-getroffen #beveiligingsfout #reisdienst #OAuth #sessiecookies #luchtvaartmaatschappijen #Trending #News #Nieuws