authentication
Safeguard articles tagged "authentication" — guides, analysis, and best practices for software supply chain and application security.
75 articles
What Is Password Salting? Why Two Identical Passwords Should Never Match
Password salting adds a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed attacks fall apart.
Web Session Security: A Practical Guide
Web session security is the set of controls that keep a logged-in user's session token from being stolen, guessed, or reused by an attacker — and most of it comes down to a handful of cookie flags and lifecycle rules teams routinely skip.
Passport (npm): A Security Review and Safe-Usage Guide
A security-focused look at the passport npm package: what it does, the session fixation CVE fixed in 0.6.0, and how to configure authentication safely.
spring-boot-starter-security: Secure Defaults and Common Mistakes
What actually happens when you add spring-boot-starter-security to your build, the defaults it turns on, and the configuration mistakes that quietly undo them.
Password Storage Best Practices Every Developer Should Follow
Storing passwords safely comes down to one rule: never store the password. Here are the password storage best practices that actually hold up against modern attacks.
Password Validation: How to Verify Credentials Securely
Password validation is more than a regex for length and symbols. Here is how to check credentials the way modern guidance actually recommends.
How to Use bcryptjs from npm Safely: A Security Review
The bcryptjs npm package is a pure-JavaScript bcrypt implementation with zero native dependencies. Here is when to reach for it, how to use it correctly, and the pitfalls that weaken password hashing.
angular-auth-oidc-client: A Security-Focused Guide to Angular OIDC
angular-auth-oidc-client is a certified Angular library for OpenID Connect and OAuth2. Here is how to use it and how to configure it securely.
What Is a Nonce? The Number Used Once in Cryptography
A nonce is a value used a single time to keep cryptographic operations fresh and stop attackers from replaying old messages. Small idea, outsized importance.
Securing a REST API: A Defense-in-Depth Checklist
Securing a REST API means layering authentication, authorization, input validation, and rate limiting so no single control is the only thing standing between an attacker and your data.
flask-security-too: What It Is and How to Use It Securely
flask-security-too is the maintained successor to Flask-Security, giving Flask apps authentication, roles, and account features out of the box. Here is what it provides and how to configure it safely.
LDAP Injection Explained With a Real Example
A walkthrough of a concrete LDAP injection example, why the filter syntax makes it dangerous, and how to detect and remediate it in real code.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.