📰 Dev.to · authagonal

Your SP validated the assertion signature, pinned the certificate, and logged the user in. Every check passed. I still replayed a login I captured an hour ago.

We challenged the second factor on the login page and never re-checked it at the token endpoint. So a valid password plus a hand-edited return URL walked straig

Our rate limiter and lockout counter keyed off the client IP. Behind nginx that IP came from a header the client could set, so one rotating header handed every

Un endpoint de restablecimiento de contraseña sin autenticación y sin límite de tasa por correo no es solo tu problema. Apúntalo a la bandeja de entrada de otra

An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their res

Single sign-on means trusting the identity provider. We trusted it for one thing too many: we resolved returning federated users by the email in the assertion,

Azure Container Apps promised to stop us paying for an idle auth cluster. We costed the migration and killed it, not over price or cold starts, but because serv

Two of our tenants were the same tenant. They had different names, different signups, and different...