Foundations, flows, and patterns for user authentication on the modern web.
What a device trust token actually is, why fingerprinting is the wrong primitive, how to scope MFA skipping safely, revocation and the active-devices list, and the failure modes that silently degrade your second factor into a decoration.
The data model and security rules for linking social, SSO, and password identities to one user — automatic vs manual linking, the trusted-email trap, unlinking rules, and how to merge two accounts that were never meant to be separate.
Password reset is the highest-value attack surface in most applications. A complete design — token handling, enumeration resistance, host header poisoning, session invalidation, and the failure modes that turn recovery into takeover.
Why email verification exists, what it genuinely proves, the four flow designs and their trade-offs, token security, deliverability, and the blocking-vs-nagging decision that quietly shapes your activation rate.
How refresh token rotation works, why token families enable automatic breach detection, the reuse-detection algorithm step by step, and the edge cases that trip teams up.
Stateful sessions vs. stateless tokens, cookie security flags, refresh token rotation, idle and absolute timeouts, and how to revoke access when it matters.
Embedded authentication keeps users in your product when they sign in, instead of bouncing them to a third-party domain. Here's how it works, what it changes, and the tradeoffs you sign up for.
OAuth & OIDC
OAuth 2.0, OpenID Connect, PKCE, and federated identity in depth.
BrowseJWT
Tokens, signatures, claims, and the things that go wrong with JWTs.
BrowseSecurity
Threats, mitigations, and defensive design for auth systems.
BrowsePasswordless
Magic links, OTPs, passkeys, and what to use when.
BrowseReact Auth
Authentication patterns specific to React and SPAs.
BrowseMulti-Tenant Auth
Designing auth for B2B SaaS — orgs, roles, and isolation.
Browse