Loading…
Authentication
18 posts about Authentication. Every summary links to the original.
From all-or-nothing to task-based OAuth consent
Cloudflare introduced OAuth scope customization to replace all-or-nothing consent flows for third-party applications. Previously, users had to approve every requested scope or deny access completely, compelling developers of tools like MCP servers to construct custom pre-consent selection interfaces. With the new feature, developers can designate specific permissions as optional alongside required scopes when configuring an OAuth client. During authorization, users can deselect these optional scopes, while unrequested client scopes remain hidden to maintain task-specific consent screens. Because resulting access tokens contain only the granted subset of permissions, client applications must inspect returned scopes after code exchange rather than assuming full authorization.
Miller VargasSecure all your internal vibe-coded applications — in one click
AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.
Chythra MalapatiAirbnb ·
Flexible Authentication: Reimagining authentication for millions of users at Airbnb
Airbnb overhauled its login and registration architecture by transitioning to a server-driven framework called Flexible Authentication. The new system separates user identification from verification, using a backend policy engine to dynamically serve the optimal auth challenge and fallback options based on regional and user context. This shift eliminated dead ends, reduced client bundle sizes, and dramatically sped up experimentation velocity across Web, iOS, and Android.
Jose SantosBuilding an open Agentic Internet: readable, discoverable, callable, and payable
The modern web produces billions of bot requests that repeatedly fetch unchanged pages, highlighting an architecture fundamentally misaligned with automated visitors acting on behalf of paying users. Cloudflare outlines an open Agentic Internet structured around four foundational capabilities: readability, discoverability, callability, and payability. Identity and access rely on open specifications such as Web Bot Auth and Private Access Control Tokens, while Markdown for Agents and the Kitesurf browser reduce token overhead and context window bloat. For execution and monetization, WebMCP exposes structured tools directly through the browser, and protocols like x402 paired with Monetization Gateway enable per-fetch transactions. These open standards allow domain owners to define tool contracts, verify bot identities, and monetize agent traffic without relying on legacy advertising models.
Jack GalileeGrab ·
Palana (Part 2): Architecting isolation, identity, and auditability for AI agents
Grab's Palana platform provisions isolated, Kubernetes-native runtime environments for autonomous AI agents using dedicated per-agent namespaces and role-based access controls. The architecture separates network enforcement across layers, applying Layer 3 and Layer 4 containment with Cilium and NetworkPolicy alongside Layer 7 application filtering evaluated by Open Policy Agent. Agent interactions with large language models route through a LiteLLM proxy wrapper that retrieves credentials from HashiCorp Vault based on Kubernetes pod context rather than client headers. Secrets management is divided between directly readable agent paths and proxy-only placeholder paths that prevent raw tokens from residing in runtime filesystems. An automated reaper monitors multi-source activity signals to shut down idle compute resources while preserving persistent storage and configuration state.
Kevin LittlejohnGrab ·
Palana (Part 1): Why Grab built a secure platform for autonomous AI Agents
Autonomous AI agents introduce significant operational and security risks when granted network access, persistent state, and credentials. To address these concerns without impeding developer productivity, Grab created Palana, an in-house Kubernetes-native execution substrate. The platform isolates each agent workload within its own namespace, pairing it with dedicated storage, network policies, and role-based access control. Network egress is funneled through an Envoy and Open Policy Agent proxy layer that audits requests and injects credentials from HashiCorp Vault using placeholder tokens, keeping raw secrets outside the agent runtime. This design allows Grab to securely host hundreds of long-running workflows, remote coding environments, and automation bots.
Kevin LittlejohnGrab ·
A Decade of Defense: Celebrating Grab's 10th Year Bug Bounty Program
Grab's bug bounty program has operated for a decade in partnership with HackerOne, expanding from an initial cohort of 23 researchers to over 850 active participants across global regions. The program's scope broadened between 2023 and 2024 to encompass artificial intelligence systems, Indonesian financial services, and a dedicated bounty table for mobile-specific security issues. Grab extended external testing coverage through live hacking appearances at ThreatCon 2023 and DEFCON 32, as well as invite-only anniversary campaigns with regional clubs in Germany, Morocco, and India. Internal cybersecurity teams manage vulnerability reports by emphasizing rapid triage times, direct communication, and payouts upon triage. Over the decade, reported vulnerabilities transitioned from foundational flaws toward more sophisticated and emerging threat categories.
Pei Shan YapGrab ·
Effortless enterprise authentication at Grab: Dex in action
Grab needed a centralised system to simplify identity management, satisfy audit requirements, and standardise authentication across internal and external tools like Databricks and Datadog. The engineering team selected OpenID Connect as their standard protocol and adopted Dex, an open-source CNCF identity aggregator. Dex acts as an intermediary between applications and multiple identity providers to issue standardised OIDC tokens. To secure service-to-service communication, Grab implemented token exchange with trusted peer relationships rather than relying on privileged service accounts. Dex also provides a kill-switch mechanism that can route authentication traffic to an alternate provider during identity provider outages.
Kah Wei LeeGrab ·
From failure to success: The birth of GrabGPT, Grab’s internal ChatGPT
Grab's machine learning platform team initially faced overwhelming volumes of repetitive user inquiries across their internal support channels. An initial attempt to automate answers using the open-source chatbot-ui framework and GPT-3.5-turbo failed to scale because the 8,000-token context limit could not accommodate extensive documentation, and embedding search proved inadequate. The project then pivoted to create an internal conversational AI platform called GrabGPT by wiring chatbot-ui with Google authentication and Grab's catwalk model-serving infrastructure. The resulting internal service rapidly expanded across the organization, providing auditable interactions, multi-model support across OpenAI, Claude, and Gemini, and private network routing to safeguard corporate data.
Wenbo WeiGrab ·
Facilitating Docs-as-Code implementation for users unfamiliar with Markdown
Adopting Docs-as-Code practices at Grab posed challenges for non-engineering team members who lacked familiarity with GitLab and Markdown syntax. To bridge this gap, Grab built a rich-text WYSIWYG TechDocs editor directly into their Backstage developer portal while preserving GitLab as the central storage backend. The team selected the Lexical framework over alternatives to enable deep customization and support non-standard elements like Kroki diagrams, Draw.io, and Excalidraw. The editor integrates OAuth 2.0 authentication to generate single-commit merge requests automatically and uses a split-screen live preview alongside concurrent session tracking to minimize Git conflicts. This approach lowered the technical barrier for non-engineers to contribute to documentation without disrupting standard repository workflows.
David KhuGrab ·
Grab AI Gateway: Connecting Grabbers to multiple GenAI providers
Grab built the AI Gateway to centralize access, cost control, and security across external and open-source Generative AI providers such as OpenAI, Azure, AWS, and Google. Designed as a set of lightweight reverse proxies, the gateway manages authentication, rate limiting, and authorization while translating payloads into a unified OpenAI-compatible interface. The platform archives request metadata and calculated per-call costs into a central data lake for auditing and showback, dynamically routing traffic across shared reserved capacity and regions to mitigate quota throttling. Supporting over 300 internal use cases, the system integrates directly with internal development notebooks and deployment tools to power applications ranging from real-time audio safety analysis to automated content moderation.
Bjorn JeeGrab ·
Embracing passwordless authentication with Grab’s Passkey
Grab introduced Passkey to replace vulnerable traditional passwords and cumbersome multi-factor methods with a seamless, phishing-resistant alternative based on the FIDO standard. The architecture relies on an authenticator located on the user's device, a frontend client, and a backend storing only public keys and metadata. During registration and login, the frontend invokes WebAuthn APIs such as navigator.credentials.create and navigator.credentials.get using server-generated challenges to prevent replay attacks. Passkeys synchronize across ecosystems via Google Password Manager and Apple iCloud Keychain, allowing users to authorize logins with their device lock screen. This implementation improves user experience, eliminates the need to store secrets in backend databases, and cuts third-party communication costs associated with OTP delivery.
Ocean NguyenGrab ·
Migrating from Role to Attribute-based Access Control
Grab's streaming data platform team migrated the Kafka Control Plane from Role-Based Access Control to Attribute-Based Access Control to eliminate operational bottlenecks and manual permission management. The previous model required defining hundreds of roles, permissions, and group mappings in an internal IAM service, leading to approval delays and stale memberships. Under the new architecture, user attributes sync from the HRMS and token payloads, while resource attributes are tagged upon creation or backfilled to reflect department and team ownership. Open Policy Agent evaluates access requests defined in Rego via middleware by comparing user attributes with resource metadata. This transition eliminated over 200 roles, 200 permissions, and roughly 3,000 unused IAM resources while automating access provisioning for new joiners.
Minh Khoi NguyenGrab ·
Zero trust with Kafka
Grab's real-time data platform team transitioned their large-scale Kafka infrastructure from basic network access controls to a zero-trust architecture. The platform implements mutual Transport Layer Security (mTLS) for offline peer authentication and encryption, driven by HashiCorp Vault's PKI engine and Strimzi on Kubernetes. Policy-Based Access Control is enforced using dedicated Open Policy Agent deployments per cluster, backed by GitOps workflows where topic owners approve JSON authorization rules. To simplify client integration, the team enhanced their Go SDK to handle ephemeral in-memory certificates, automatic renewals, and configurable retries. While the security posture improved, the Java encryption and decryption overhead caused a drop in streaming throughput.
Fabrice HarbulotGrab ·
How facial recognition technology keeps you safe
Grab utilizes facial recognition technology across its platform for driver authentication, passenger verification, and digital electronic Know Your Customer (e-KYC) processes. The core pipeline consists of image preprocessing through face detection and alignment, anti-spoofing checks, feature extraction into high-dimensional vector embeddings, and downstream verification or search. To counter spoof attacks like screen replays, synthetic moiré patterns are generated and cropped face patches are used during training and inference to focus on local structures rather than global semantic noise. Face verification challenges involving shallow ID datasets and masked faces are resolved using semi-Siamese training architectures and masked data augmentations.
Kai Feng TeeGrab ·
Biometric authentication - Why do we need it?
Grab addressed the vulnerabilities and costs associated with SMS one-time passwords and PINs by implementing device-level biometric authentication. The architecture pairs device biometric sensors with hardware secure enclaves to protect private keys separately from the main operating system. During enrollment, Grab generates a public-private key pair using SHA512withECDSA, authenticates the user locally, and stores reference identifiers in encrypted device storage. HellfireSDK verifies that the device is not rooted, ensuring raw biometric data never leaves the handset. Early experimental runs indicate an adoption rate exceeding 90% and a login success rate near 90%.
Chad BurgessGrab ·
Securing and Managing Multi-cloud Presto Clusters with Grab’s DataGateway
Grab's data engineering team needed to manage data access across growing Presto workloads spanning hundreds of users, thousands of tables, and multiple clouds without exposing infrastructure churn to clients. Out-of-the-box Presto lacked fine-grained schema- and table-level access controls, unified endpoint routing, and seamless cluster switching. To solve this, the team built DataGateway, a smart HTTP proxy and abstraction layer deployed as microservices on Kubernetes. The platform parses incoming SQL statements, verifies user access control lists against target schemas and tables, and dynamically routes queries to appropriate AWS or Azure Presto clusters without requiring endpoint updates. This architecture enabled zero-disruption cluster migrations across 40 clusters and unified access management across a multi-cloud data lake environment.
Vinnson LeeGrab ·
Migrating Existing Datastores
Grab's Identity team faced imminent memory exhaustion on a single Redis node used to cache mobile authentication tokens under rapid user growth. Because read traffic outweighed write traffic by roughly 200 times, the team opted for an AWS ElastiCache cluster with three shards and two read replicas per shard. They executed a zero-downtime, six-phase migration plan while handling a peak load of 20,000 queries per second. The migration transitioned through initial one-time data replication, asynchronous shadow writes, synchronous dual writes, asynchronous read validation, switching primary reads, and final write cleanup. Controlled by feature flags and monitored with metrics at every stage, the migration completed without invalidating tokens or causing service disruptions.
Nishant Gupta