Identity & Access

A review point for a fast-moving TypeScript authentication framework's controls and trade-offs

A mutable implementation reference for Better Auth's password hashing, secret rotation, sessions, CSRF and redirect defenses, cookies, OAuth state and PKCE, rate limiting, proxy trust, and outbound requests. Use it to assess framework configuration, not as a substitute for OAuth, OIDC, or WebAuthn standards.

Keyless authentication from external CI/CD systems to Google Cloud

A practical guide to exchanging deployment-platform OIDC tokens for short-lived Google Cloud credentials with explicit admission and IAM controls.

Trust, least-privilege, and audit controls for external workloads

Google's security guidance for hardening federated workload trust against spoofing, privilege escalation, weak audit trails, and malicious credential configurations.

Current OAuth deployment requirements for redirect flows, tokens, clients, and proxies

The IETF's OAuth 2.0 Security Best Current Practice updates the original framework's threat model and deployment advice. It requires or recommends stricter redirect handling, PKCE, replay defenses, token privilege restriction, secure client authentication, and hardened proxy boundaries while deprecating weaker grants and response modes.

The normative identity layer over OAuth 2.0 and its token-validation contract

OpenID Connect Core defines authentication over OAuth 2.0 using signed ID Tokens and, optionally, UserInfo. It specifies flows, claims, subject identifiers, discovery relationships, and relying-party validation, but its historic implicit and hybrid flows need constraints from current OAuth security guidance.

The stable W3C baseline for origin-bound public-key registration and authentication

The W3C Recommendation defines the browser and relying-party contract for registering and using origin-bound public-key credentials. It is the stable normative baseline for WebAuthn ceremonies, server verification, authenticator data, user presence and verification, attestation, privacy, and security considerations.