authentication
Safeguard articles tagged "authentication" — guides, analysis, and best practices for software supply chain and application security.
75 articles
Secure Session Management: A Practical Guide for Web Apps
Secure session management comes down to a handful of decisions about cookies, storage, expiry, and rotation. Get those right and you close off most session-based attacks.
jsonwebtoken npm: Security Review and Safe Usage
The jsonwebtoken npm package signs and verifies JWTs for countless Node apps, and versions at or below 8.5.1 carry serious verification flaws. Here is how to use npm jsonwebtoken safely.
User Session Management: A Security Guide
Session management is where most authentication bugs actually live. This guide covers how to issue, store, rotate, and revoke sessions without opening holes attackers walk straight through.
What Is a PAT Token and How Do You Keep It Secure?
A PAT token is a personal access token that stands in for your password when scripts and tools talk to services like GitHub. Here's how it works and how to stop it leaking.
firebase/php-jwt: Verifying JWTs Without Getting Burned
firebase/php-jwt is the de facto library for encoding and decoding JSON Web Tokens in PHP. Here is how to use it correctly and avoid the algorithm-confusion trap.
How to Configure a Git SSH Key Safely
Setting up a Git SSH key gives you secure, password-free authentication. Here is how to generate one, configure Git, and avoid the common security mistakes.
CVE-2024-22234: The Spring Security Access Control Bypass Explained
CVE-2024-22234 is a broken access control flaw in Spring Security where isFullyAuthenticated returns true for a null authentication. Here is how it works and how to fix it.
What Is a Cross-Site Request Forgery Vulnerability?
A cross-site request forgery vulnerability tricks a logged-in user's browser into sending unwanted requests. Here is how it works and how to shut it down.
What Is Mutual TLS (mTLS)? Two-Way Authentication Explained
Mutual TLS makes both sides of a connection prove their identity with certificates, not just the server. It is the backbone of zero-trust communication between services.
angular-oauth2-oidc: Secure OAuth2 and OIDC in Angular
angular-oauth2-oidc is the most widely used OAuth2 and OpenID Connect client for Angular apps. Here is how to wire it up with PKCE, validate tokens correctly, and avoid the config mistakes that leak sessions.
Storing Passwords Securely: What Actually Works
Storing a password means storing a slow, salted hash of it, never the password itself. Here is the modern approach that survives a database breach.
What Is a JWT (JSON Web Token)
A JWT is a compact, signed token that carries claims like who a user is between parties. Learn its three parts, how signing works, and the common security pitfalls.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.