Sauvik Biswas

JWKS and RS256: Dropping the Shared JWT Secret

Intermission: What Industry Ships and Who Gets Paid

Adding OpenID Connect on Top of OAuth 2

Splitting the Auth Server from the Resource Server

Refresh Tokens and Silent Re-authentication

Using the Access Token on a Protected API

Adding PKCE to Stop Authorization Code Interception

Adding OAuth State to Stop CSRF

Learning OAuth 2 by Building It, One Version at a Time

Debezium and the growing pg_wal