Authentication patterns specific to React and SPAs.
The refresh interceptor everyone writes, and the five bugs it has — thundering herds, cross-tab races, retrying non-idempotent requests, background tabs, and the logout that discards a half-written form.
The App Router changed where authentication runs. Layouts that don't re-render, middleware that shouldn't authorize, the client/server boundary and what leaks across it, streaming and Suspense, and why every route must check for itself.
How browser privacy changes — Safari ITP, Chrome's Privacy Sandbox, storage partitioning — broke cookie-based iframe authentication, and the token-by-message pattern that replaces it.
Iframe-based auth looks like a clean way to embed a sign-in form. The browser thinks otherwise. Here's what actually breaks — cookies, postMessage, ITP, focus, autofill — and the patterns that survive contact with real users.
Authentication
Foundations, flows, and patterns for user authentication on the modern web.
BrowseOAuth & OIDC
OAuth 2.0, OpenID Connect, PKCE, and federated identity in depth.
BrowseJWT
Tokens, signatures, claims, and the things that go wrong with JWTs.
BrowseSecurity
Threats, mitigations, and defensive design for auth systems.
BrowsePasswordless
Magic links, OTPs, passkeys, and what to use when.
BrowseMulti-Tenant Auth
Designing auth for B2B SaaS — orgs, roles, and isolation.
Browse