authentication
Safeguard articles tagged "authentication" — guides, analysis, and best practices for software supply chain and application security.
78 articles
spring-security-core: A Practical Security Guide
The spring-security-core artifact is the foundation of Spring Security, providing authentication and authorization primitives. Here is how to use it safely.
How to secure a REST API
REST API breaches from T-Mobile to Optus trace to a handful of recurring mistakes. Here's how to fix authorization, auth, injection, and rate limiting.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
Password Salt and Hash: How to Store Passwords Safely
Storing a password means hashing it with a slow algorithm and a unique salt, never encrypting it or saving it in plaintext. Here's how salting and hashing actually protect users.
System.IdentityModel.Tokens.Jwt: A Security Guide for .NET JWT Handling
System.IdentityModel.Tokens.Jwt is the standard .NET library for JSON Web Tokens, but a DoS CVE and a few validation defaults decide whether your token handling is actually safe.
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
jwt-decode: Why Decoding Is Not Verifying (Security Guide)
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
What Is Password Salting? Why Two Identical Passwords Should Never Match
Password salting adds a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed attacks fall apart.
Web Session Security: A Practical Guide
Web session security is the set of controls that keep a logged-in user's session token from being stolen, guessed, or reused by an attacker — and most of it comes down to a handful of cookie flags and lifecycle rules teams routinely skip.
Passport (npm): A Security Review and Safe-Usage Guide
A security-focused look at the passport npm package: what it does, the session fixation CVE fixed in 0.6.0, and how to configure authentication safely.
spring-boot-starter-security: Secure Defaults and Common Mistakes
What actually happens when you add spring-boot-starter-security to your build, the defaults it turns on, and the configuration mistakes that quietly undo them.
Password Storage Best Practices Every Developer Should Follow
Storing passwords safely comes down to one rule: never store the password. Here are the password storage best practices that actually hold up against modern attacks.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.