authentication
Safeguard articles tagged "authentication" — guides, analysis, and best practices for software supply chain and application security.
78 articles
firebase/php-jwt: Verifying JWTs Without Getting Burned
firebase/php-jwt is the de facto library for encoding and decoding JSON Web Tokens in PHP. Here is how to use it correctly and avoid the algorithm-confusion trap.
How to Configure a Git SSH Key Safely
Setting up a Git SSH key gives you secure, password-free authentication. Here is how to generate one, configure Git, and avoid the common security mistakes.
CVE-2024-22234: The Spring Security Access Control Bypass Explained
CVE-2024-22234 is a broken access control flaw in Spring Security where isFullyAuthenticated returns true for a null authentication. Here is how it works and how to fix it.
What Is a Cross-Site Request Forgery Vulnerability?
A cross-site request forgery vulnerability tricks a logged-in user's browser into sending unwanted requests. Here is how it works and how to shut it down.
What Is Mutual TLS (mTLS)? Two-Way Authentication Explained
Mutual TLS makes both sides of a connection prove their identity with certificates, not just the server. It is the backbone of zero-trust communication between services.
angular-oauth2-oidc: Secure OAuth2 and OIDC in Angular
angular-oauth2-oidc is the most widely used OAuth2 and OpenID Connect client for Angular apps. Here is how to wire it up with PKCE, validate tokens correctly, and avoid the config mistakes that leak sessions.
Storing Passwords Securely: What Actually Works
Storing a password means storing a slow, salted hash of it, never the password itself. Here is the modern approach that survives a database breach.
What Is a JWT (JSON Web Token)
A JWT is a compact, signed token that carries claims like who a user is between parties. Learn its three parts, how signing works, and the common security pitfalls.
What Is SAML
SAML lets an identity provider vouch for you to other applications using signed XML assertions. Learn how it powers enterprise single sign-on and how it works.
What Is OpenID Connect (OIDC)
OpenID Connect adds a real identity layer on top of OAuth 2.0. Learn how it proves who a user is, what an ID token contains, and how it differs from plain OAuth.
MCP Authentication Patterns for Enterprise
Enterprise MCP deployments need more than a static API key. The protocol is evolving toward OAuth 2.1 and dynamic client registration, and understanding which pattern fits which workload decides whether your rollout survives the first audit.
OAuth vs API Keys
OAuth and API keys aren't interchangeable: one is a static, long-lived credential, the other a scoped, expiring token. Here's how to choose, backed by real breaches.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.