Loading…
Topic
232 posts about Authentication. Every summary links to the original.
See the idea
A model deployed on AKS is open by default. See how MaaS policies insert Authorino authentication and Limitador rate limits in front of vLLM, so bad keys and over-quota requests stop at the gate.
See how an agent request becomes an allowed or denied tool action through identity context, policy checks, scoped credentials, and an auditable decision trail.
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
This tutorial shows how to build a React Native image-sharing or file-sharing app with Expo SDK49, Supabase Authentication, Expo Router v2, and Supabase Storage. It configures a Supabase project, turns off email confirmation for the tutorial, creates a private files bucket, and adds policies that constrain access to an authenticated user’s own folder. The React Native client stores sessions in AsyncStorage, uses the Image Picker and Expo File System, and initializes Supabase with environment-based URL and public key values. The resulting app supports account creation, sign-in, image selection, listing, download-based display, and deletion; resumable uploads are omitted because the attempted implementation produced files with zero bytes.
Shopify now recommends Remix for building Admin apps, which merchants use to configure apps, view data, and integrate services within Shopify Admin. Because these apps run in cross-origin iframes, browser restrictions can block cookies, storage, URL updates, and direct access to the Admin interface; App Bridge uses postMessage() to restore capabilities and support deeper integration. The new App Bridge client replaces the previous package, requires only a script tag, and makes standard web APIs such as history.pushState() work with Admin apps. The Remix template uses file-based routes, server-side loaders and actions, implicit API handling, and Shopify-specific integrations supplied by @shopify/shopify-app-remix, with Prisma provided for storage and sessions. Shopify integrated the template into Shopify CLI and describes it as the beginning of broader platform and design-system reworks.
This tutorial shows how to add Google authentication to a cross-platform Flutter application using the Supabase SDK for Flutter. It explains OpenID Connect as a protocol built on OAuth 2.0, then configures Google Cloud client IDs for iOS, Android, and web, with Supabase using the web client ID to verify the supplied identity token. The sample initializes Supabase, starts Google sign-in through google_sign_in, passes the resulting access and ID tokens to signInWithIdToken, and listens for signed-in events to navigate from LoginScreen to ProfileScreen. The profile reads avatar_url and full_name from Supabase userMetadata, while a sign-out action returns the user to the login screen, producing a basic personalized app.
PostgREST v11.1 is available on the Supabase platform with configuration and querying improvements, plus a small set of documented breaking changes from v10. It lets JWT-authenticated impersonated roles such as anon, authenticated, and service_role receive ALTER ROLE settings, including statement timeouts, pg_plan_filter statement cost limits, and configurable transaction isolation levels. The release also supports bulk JSON inserts that preserve column defaults when defaultToNull is false, and adds any/all modifiers for several filters, including eq, like, ilike, and comparison filters. For HTTP clients outside Supabase libraries, Range is now ignored on non-GET requests and RPC requests no longer use the deprecated Prefer: params=multiple-objects header; existing Supabase projects can upgrade by pausing and unpausing.
Fly.io describes a security problem in its Rails-based platform: as the application accumulated secrets, Rails became the part of the attack surface least trusted, yet still handled many operations involving bearer tokens. It compares model encryption, Vault or KMS, and narrowly scoped secret-handling services, noting that each leaves gaps or creates operational overhead when secrets must be read for arbitrary third-party APIs. The proposed Tokenizer is a stateless HTTP proxy holding a Curve25519 private key; encrypted secrets travel in Proxy-Tokenizer headers, and the proxy injects plaintext or computes HMACs while host allowlists constrain misuse. A companion SSOkenizer performs OAuth2 flows outside Rails, tokenizes resulting bearer tokens, and returns credentials usable only through Tokenizer. The tools are open source, and the design provides a path for third-party integrations and SSO without adding raw secrets to Rails.
Supabase’s June 2023 beta update announces product, tooling, authentication, billing, and community developments. Mozilla chose Supabase Vector and OpenAI for AI Help, an AI chatbot that supports search and discovery for MDN, while Supabase Auth added native Sign in with Apple and Google support for one-tap methods including web integrations and Chrome extensions. The Supabase CLI added Dashboard migration visibility with executed SQL, local serving for all Functions, and a usage flag for monitoring key Postgres statistics; Studio also gained usage, overage, plan-limit, subscription, billing, and compute-detail improvements. Other updates include Kakao login, a Realtime Inspector for testing endpoints with JWTs and Row Level Security policies, an object ID in Storage upload responses, OrioleDB parallel index builds, database partitioning guidance, community projects, and an upcoming Launch Week.
Supabase has expanded its authentication support for native Apple and Google sign-in on iOS and Android, addressing a flow that previously required developers to send users through a web browser. Native apps built with Flutter or React Native can use OS-provided authentication dialogs across Apple platforms including iOS, macOS, tvOS, and watchOS, while Android support covers all Android variants. Behind these methods, ID tokens issued by Apple or Google are validated by Supabase Auth to create accounts or link existing accounts based on email similarity. The same signInWithIdToken() method also enables Sign in with Apple JS, Google One Tap, and authentication in Chrome extensions; the Google One Tap example passes the provider’s credential and a matching nonce when one is supplied via data-nonce.
Enterprise customers want employees to use a centralized authentication process called Single Sign On (SSO). This post introduces an enterprise-ready Devday23 presentation series focused on what enterprise readiness means, what enterprises look for, and how to build an enterprise-ready MVP SaaS application. Its identity-focused material explains the role of SSO in SaaS applications and points readers to Dan Marma, Product Acceleration Principal Architect, for the “Single Sign On (SSO) in your SaaS applications” presentation. The series will also cover moving an application beyond identity MVP toward elevated authentication mechanisms in later posts. It invites questions and continued content through Twitter and YouTube.
Moving a SaaS application from B2C or small-company B2B customers to enterprise customers raises questions about whether enterprise buyers have different expectations. This installment of the Devday23 enterprise-ready presentation series focuses on what enterprises look for when selecting SaaS applications, with particular attention to identity and how customers would use the application. The WIC Devday 23 virtual conference addressed the topic through a presentation by Jon Lehtinen, director for “Okta on Okta” products at Okta. The broader series also covers enterprise readiness, authentication considerations, user management, authentication mechanisms, building an enterprise-ready MVP SaaS app, and taking that app beyond MVP, while the supplied text does not provide the presentation’s specific answers or conclusions.
What makes a SaaS application ready for enterprise customers when identity is involved? This Devday23 keynote introduces enterprise readiness as a concern spanning application security, user onboarding, scalable authentication, identity, user management, and automation. Arnab Bose, Chief Product Officer for Workforce Identity Cloud at Okta, leads the presentation’s “Why” and “What” questions in a half-day virtual conference hosted at WIC Devday 23. The keynote is positioned as the opening of a series covering enterprise customer expectations, building an enterprise-ready MVP, moving beyond MVP, authentication considerations, user management, and stronger authentication mechanisms; a related “Setting the Bar for Enterprise-Grade Identity” whitepaper provides benchmarks for secure SaaS management.
Supabase’s May 2023 update announces two major product areas: Supabase Vector, an open-source toolkit for storing, indexing, and querying Postgres vector embeddings at scale, and Supabase Vault, a Postgres extension and UI for encrypted secrets and data. Auth Helpers now support client and server use of the Next.js App Router and server-side authentication by default with PKCE. The release also adds Turnstile CAPTCHA support, password reauthentication nonces, Wrappers integrations for Firebase, Stripe, S3, and clickhouse, CLI deployment for all Edge Functions, custom and vanity domains, and generally available Image Transformation. Supabase says it reached 50,000 GitHub stars, while the team solicits Dashboard SQL Editor feedback and reports community projects, AI resources, and a first-ever Flutter Hackathon.
Okta’s Workforce Developer Advocacy Team has launched a monthly Workforce Identity Developer Podcast for education about identity and development for customers using Okta as their identity provider. The first highlighted episodes cover Workforce Identity, security history, phishing-resistant MFA, and the relative benefits and drawbacks of WebAuthN and Passkeys; another compares OAuth application integrations with older SSWS tokens. A further episode discusses building SaaS for enterprise customers, including the “Enterprise-Ready MVP,” broadening “Okta Developers” to people building code for Okta customers, and extreme enterprise use cases. Audio is available on Casted, while new content and feedback are supported through social channels, YouTube, and comments on the developer forum.
Supabase’s April 2023 Beta Update reports on Launch Week 7 and a broad set of product, ecosystem, and community announcements. It open-sources Logflare as Supabase Logs, adds a self-hostable Edge Runtime for Deno Functions, and presents Storage v3’s resumable uploads for files up to 50GB, with quality filters, Next.js support, and WebP support. Auth additions include SAML 2.0 SSO, PKCE, Sign in with Apple for iOS, and server-side support, while Studio 2.0 brings redesigns, developer-experience improvements, and new AI features. The update also announces dbdev, a PostgreSQL package manager, Trusted Language Extensions for Postgres, pg_graphql v1.2, search using GitHub Discussions, API report improvements, and a storage permission change, while noting Page Assist as the hackathon winner and Firecrawl’s move from Pinecone to Supabase for PostgreSQL vector embeddings.
The tutorial presents a Flutter app that requires multi-factor authentication before users can view its content, using email and password login followed by authenticator-app verification. It uses Supabase for authentication, supabase_flutter for client integration, go_router for routes and redirects, and flutter_svg to display a QR code for authenticator enrollment. During signup, users confirm their email through a deep link, enroll MFA, and then verify a code; login applies a similar second step. iOS and Android deep-link configuration directs the confirmation callback to the enrollment route, while routing checks the session and authenticator assurance level to send users to registration, enrollment, or verification as appropriate. The stated outcome is that only users who have signed in via MFA can access the home page, while optional MFA is identified as a possible future variation.
In 2021, GitHub released OpenID Connect support for GitHub Actions to let workflows retrieve short-lived cloud session tokens instead of storing static secrets. Tinder Security Labs discovered widespread IAM role misconfigurations that allow external repositories to assume target roles and access AWS resources. The primary issue stems from IAM trust policies that authenticate the GitHub identity provider but omit strict validation on the subject claim. Researchers located exposed role identifiers via public workflow searches and confirmed that arbitrary external GitHub Actions workflows could assume them, including roles within AWS official repositories. Remediation requires configuring trust policies to restrict the audience and validate repository namespaces, while unauthorized assumptions can be detected in CloudTrail logs.
Supabase Auth announces SAML 2.0 Single Sign-On, PKCE support for server-side rendering and mobile authentication, and native Sign in with Apple on iOS. SSO lets users authenticate through a company identity provider, with dashboard configuration, Supabase CLI commands, a `signInWithSSO()` call, and PostgreSQL Row Level Security support using the provider identifier in a user JWT. PKCE addresses implicit-flow risks with a code verifier, code challenge, authorization code, and server-side exchange for a session, enabling same-domain cookies, protected server-rendered pages, and downstream actions after authentication. The release also allows an iOS Bundle ID to be configured for Apple provider access and supports `supabase.auth.signInWithApple()` in supabase-flutter without deep links or parameters. SSO is available on the Pro Plan and above and self-hosted, while server-side Auth using PKCE is now available on all projects.
Shop Pay and the Shop app began deploying passkeys in December 2022 across web and native app authentication, initially as an additional method for existing users and as a replacement for email and SMS verification. Passkeys use public-key cryptography: the private key remains on the device, while the service stores a public key, with platform or roaming authenticators providing options such as biometrics or hardware keys. Built on Ruby on Rails, Shop used webauthn-ruby to store a server challenge during registration, verify the allowed domain and challenge, and save the credential identifier; login looks up that identifier and verifies authentication while updating the sign count. The team also integrated passkeys into an iframe-capable login component for use across Shopify interactions, including merchant storefronts. Domain scoping, authenticator settings, challenge handling, Conditional UI, and cross-device interoperability are identified as important implementation considerations.
Supabase’s February 2023 beta update covers product changes across its dashboard, Auth, Postgres, Edge Functions, GraphQL, documentation, and community resources. GraphiQL is now built into the dashboard for exploring and querying pg_graphql APIs, while Docs search uses pgvector and OpenAI to support Supabase-specific questions. Supabase CLI 1.36+ can serve multiple Edge Functions simultaneously, and a multi-stage Postgres Dockerfile reduces the image from 1.3GB to 250MB, enabling faster boot time. The release also adds dashboard management for database roles, moves API documentation into the table editor with type-file generation, and provides a full OpenAPI 3.0 specification for Auth. Additional updates include inferred supabase-js response types, Deno 1.30.3 for Edge Functions, and Realtime behavior for deletes under RLS.
Grab's streaming data platform team migrated the Kafka Control Plane from Role-Based Access Control to Attribute-Based Access Control to eliminate operational bottlenecks and manual permission management. The previous model required defining hundreds of roles, permissions, and group mappings in an internal IAM service, leading to approval delays and stale memberships. Under the new architecture, user attributes sync from the HRMS and token payloads, while resource attributes are tagged upon creation or backfilled to reflect department and team ownership. Open Policy Agent evaluates access requests defined in Rego via middleware by comparing user attributes with resource metadata. This transition eliminated over 200 roles, 200 permissions, and roughly 3,000 unused IAM resources while automating access provisioning for new joiners.
Supabase’s January 2023 beta update gathers releases across Postgres, GraphQL, Edge Functions, client libraries, image transformation, and self-hosting. The update adds pgvector, a PostgreSQL extension for storing OpenAI embeddings and performing vector similarity search, and presents Supabase Clippy, a one-week, fully open-source documentation-search MVP combining pgvector with OpenAI. pg_graphql now supports Views, Materialized Views, and Foreign Tables, while Image Transformations enable automatic WebP conversion by default, with format: origin available to opt out. Other changes include Python and C# reference documentation, pg_repack, multi-tab authentication logout through BroadcastChannel, lz4 compression, ICU locales, downloadable Edge Function source, and a DigitalOcean deployment guide using Sendgrid, Packer, and Terraform. Supabase also reports reaching 45,000 GitHub stars and a position among the top 200 most-popular repositories.
The best engineering reads, once a week.
