New to this library, not necessarily new to the world.
Time To Program explains server-side sessions, JWT validation and revocation, OAuth delegated authorization, and OpenID Connect login through web, mobile, and multi-service scenarios. A practical introduction to choosing and combining these mechanisms, not a complete protocol implementation guide.
Time To Program · Source dated 12 Oct 2026
A practical guide to exchanging deployment-platform OIDC tokens for short-lived Google Cloud credentials with explicit admission and IAM controls.
Google Cloud · Source dated 28 Aug 2026
Google's security guidance for hardening federated workload trust against spoofing, privilege escalation, weak audit trails, and malicious credential configurations.
Google Cloud · Source dated 28 Aug 2026
The IETF's OAuth 2.0 Security Best Current Practice updates the original framework's threat model and deployment advice. It requires or recommends stricter redirect handling, PKCE, replay defenses, token privilege restriction, secure client authentication, and hardened proxy boundaries while deprecating weaker grants and response modes.
RFC Editor · Source dated 30 Jan 2025
OpenID Connect Core defines authentication over OAuth 2.0 using signed ID Tokens and, optionally, UserInfo. It specifies flows, claims, subject identifiers, discovery relationships, and relying-party validation, but its historic implicit and hybrid flows need constraints from current OAuth security guidance.
OpenID Foundation · Source dated 15 Dec 2023
OWASP's second API Security Top 10 is an awareness and threat-modeling taxonomy, not an implementation standard. Its ten risk families connect object, property, and function authorization with authentication, resource consumption, business-flow abuse, SSRF, configuration, inventory, and third-party API trust.
OWASP Foundation · Source dated 5 Jun 2023
The W3C Recommendation defines the browser and relying-party contract for registering and using origin-bound public-key credentials. It is the stable normative baseline for WebAuthn ceremonies, server verification, authenticator data, user presence and verification, attestation, privacy, and security considerations.
World Wide Web Consortium (W3C) · Source dated 8 Apr 2021
A mutable implementation reference for Better Auth's password hashing, secret rotation, sessions, CSRF and redirect defenses, cookies, OAuth state and PKCE, rate limiting, proxy trust, and outbound requests. Use it to assess framework configuration, not as a substitute for OAuth, OIDC, or WebAuthn standards.
Better Auth · Source dated 29 Aug 2026
Google's reference foundation for consistent resource hierarchy, identity, networking, logging, policy, secrets, keys, and threat detection at enterprise scale.
Google Cloud · Source dated 15 May 2025
Ten 2020–2021 episodes explaining how provider protections and customer controls fit together: identity, data access, hardware, service accounts, security logging, and audit trails.
Google Cloud Tech
Source dated 5 Feb 2020
Source dated 3 Jul 2021
Source dated 26 May 2021
Source dated 7 May 2021
Source dated 14 Apr 2020
Source dated 28 Apr 2020
Source dated 13 May 2021
Source dated 19 Feb 2020
Source dated 3 Mar 2020
Source dated 24 Mar 2020
From Getting Started with Cloud Security Command Center
Google Cloud Tech · Source dated 18 Sept 2019