Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
A logout URL that works on any GET lets any page sign users out. Require user confirmation or validate id_token_hint on every RP-initiated logout.
An OpenID Provider should allow code, and at most the hybrid id_token code flow. Never the implicit token flow. Here is what to turn off and how to check.
A logout token is a JWT that can end sessions. Check its type, its events claim, the absence of a nonce, and a short lifetime, or attackers can force logouts.
An ID Token issued for another application must not log users into yours. Compare the aud claim with your own client_id every time.
A client that fetches discovery metadata must compare the issuer value exactly with the one it was configured to expect. Otherwise a rogue server can pose as your provider.
Key your user records on the issuer plus sub claim. Emails and usernames can be reassigned, which can hand one person's account to another.
An OIDC client must bind each ID Token to the login that requested it. Generate a nonce, store it, and compare it on return. Code and tests for Node and Python.
Users need a screen where they can revoke refresh tokens and reference access tokens. Here is what to build, how revocation propagates, and how to test it.
Sliding refresh token expiry is fine only if a hard cap exists. Set an absolute lifetime so a stolen token cannot stay alive forever.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
