📰 Dev.to · authagonal

We challenged the second factor on the login page and never re-checked it at the token endpoint. So a valid password plus a hand-edited return URL walked straig

Our rate limiter and lockout counter keyed off the client IP. Behind nginx that IP came from a header the client could set, so one rotating header handed every

An unauthenticated password-reset endpoint with no per-email rate limit is not just your problem. Point it at someone else's inbox and you have turned their res

Azure Container Apps promised to stop us paying for an idle auth cluster. We costed the migration and killed it, not over price or cold starts, but because serv

Two of our tenants were the same tenant. They had different names, different signups, and different...