📰 Dev.to · authagonal

We added a signature-checking admission webhook to our Kubernetes cluster so unsigned images could never run. Hours later one Deployment had 2,242 ReplicaSets,

We challenged the second factor on the login page and never re-checked it at the token endpoint. So a valid password plus a hand-edited return URL walked straig

Our rate limiter and lockout counter keyed off the client IP. Behind nginx that IP came from a header the client could set, so one rotating header handed every

An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their res

Most auth vendors fence SSO, SCIM, MFA, and audit logs behind an Enterprise plan. We put all of them on the $0 tier. Here is the unit economics that makes givin

Single sign-on means trusting the identity provider. We trusted it for one thing too many: we resolved returning federated users by the email in the assertion,

Azure Container Apps prometía que dejáramos de pagar por un clúster de autenticación inactivo. Calculamos el coste de la migración y la descartamos, no por el p

Azure Container Apps promised to stop us paying for an idle auth cluster. We costed the migration and killed it, not over price or cold starts, but because serv

Login is a weekend. The bill arrives after: signature verification, SCIM deprovisioning, MFA, audit logs, key rotation, breach liability, and on-call for a tier

Two of our tenants were the same tenant. They had different names, different signups, and different...

We sell authentication, which makes our scariest question a simple one: when a customer wires their...

There's a version of dogfooding that's a slogan, and a version where your own employees can't ship...

Your Terraform state file is the single most sensitive artifact in your cloud. It is a complete map...