Tag

authentication

2 cards

Cards

A user fired at 10am whose JWT stays valid until 11, the three parts of a self-contained token, and short-lived access tokens paired with a server-side refresh token that can actually be invalidated

SecurityDay 50Sep 21, 2026

The Token We Can't Take Back

system-design security jwt

Handing an app a password against granting it a scoped token, the five steps by which the app never sees the credential, and what OpenID Connect adds on top of OAuth

SecurityDay 49Sep 20, 2026

Let Them In Without Giving Them the Keys

system-design security oauth