authentication
Safeguard articles tagged "authentication" — guides, analysis, and best practices for software supply chain and application security.
75 articles
Snyk Login: A Security Guide to Authentication and Access
The Snyk login flow supports SSO, identity-provider integration, and CLI token auth. Here is how each works and how to keep your Snyk account access secure.
Spring Security Configuration Guide: The Modern SecurityFilterChain Approach
A practical Spring Security configuration guide for 2026 using the component-based SecurityFilterChain, method security, CSRF, CORS, and password encoding.
Authentication vs Authorization: What's the Difference?
Authentication proves who you are. Authorization decides what you're allowed to do. One is the ID check at the door; the other is the list of rooms you can enter.
Web Session Management: A Security Guide for Developers
Web session management is how an application remembers who a user is across stateless HTTP requests. Get the session identifier, storage, and lifecycle wrong and you hand attackers the keys.
CVE-2023-41080: Apache Tomcat Open Redirect in FORM Authentication
CVE-2023-41080 lets a crafted URL trigger an open redirect during FORM login on Tomcat's ROOT web app. Here is the exact condition, affected versions, and the one-line fix path.
spring-security-core: A Practical Security Guide
The spring-security-core artifact is the foundation of Spring Security, providing authentication and authorization primitives. Here is how to use it safely.
How to secure a REST API
REST API breaches from T-Mobile to Optus trace to a handful of recurring mistakes. Here's how to fix authorization, auth, injection, and rate limiting.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
Password Salt and Hash: How to Store Passwords Safely
Storing a password means hashing it with a slow algorithm and a unique salt, never encrypting it or saving it in plaintext. Here's how salting and hashing actually protect users.
System.IdentityModel.Tokens.Jwt: A Security Guide for .NET JWT Handling
System.IdentityModel.Tokens.Jwt is the standard .NET library for JSON Web Tokens, but a DoS CVE and a few validation defaults decide whether your token handling is actually safe.
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
jwt-decode: Why Decoding Is Not Verifying (Security Guide)
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.