Identity & Access

Useful — Connects session revocation, JWT storage, OAuth delegation, and OIDC login through concrete architecture choices; an introduction rather than a protocol implementation reference.

Choosing session state, token formats, delegated access, and identity-provider login

Time To Program explains server-side sessions, JWT validation and revocation, OAuth delegated authorization, and OpenID Connect login through web, mobile, and multi-service scenarios. A practical introduction to choosing and combining these mechanisms, not a complete protocol implementation guide.

Useful — Explains framework-specific configuration and revocation trade-offs; mutable implementation documentation does not replace standards.

A review point for a fast-moving TypeScript authentication framework's controls and trade-offs

A mutable implementation reference for Better Auth's password hashing, secret rotation, sessions, CSRF and redirect defenses, cookies, OAuth state and PKCE, rate limiting, proxy trust, and outbound requests. Use it to assess framework configuration, not as a substitute for OAuth, OIDC, or WebAuthn standards.

Essential — Provides a practical federation implementation route that separates workload admission from application-user authorization.

Keyless authentication from external CI/CD systems to Google Cloud

A practical guide to exchanging deployment-platform OIDC tokens for short-lived Google Cloud credentials with explicit admission and IAM controls.

Essential — Explains workload trust boundaries, credential threats, and audit controls for Google Cloud federation.

Trust, least-privilege, and audit controls for external workloads

Google's security guidance for hardening federated workload trust against spoofing, privilege escalation, weak audit trails, and malicious credential configurations.

Essential — Defines OAuth security practices for redirects, PKCE, tokens, and replay defenses.

Current OAuth deployment requirements for redirect flows, tokens, clients, and proxies

The IETF's OAuth 2.0 Security Best Current Practice updates the original framework's threat model and deployment advice. It requires or recommends stricter redirect handling, PKCE, replay defenses, token privilege restriction, secure client authentication, and hardened proxy boundaries while deprecating weaker grants and response modes.

Essential — Defines identity and ID Token validation; pair its historical flow descriptions with modern OAuth security guidance.

The normative identity layer over OAuth 2.0 and its token-validation contract

OpenID Connect Core defines authentication over OAuth 2.0 using signed ID Tokens and, optionally, UserInfo. It specifies flows, claims, subject identifiers, discovery relationships, and relying-party validation, but its historic implicit and hybrid flows need constraints from current OAuth security guidance.

Useful — Provides a specialist normative reference for public-key credential ceremonies; check standards status when implementing.

The stable W3C baseline for origin-bound public-key registration and authentication

The W3C Recommendation defines the browser and relying-party contract for registering and using origin-bound public-key credentials. It is the stable normative baseline for WebAuthn ceremonies, server verification, authenticator data, user presence and verification, attestation, privacy, and security considerations.