Sauvik Biswas

Tales From a Startup: Opinions

Resource Indicators: Binding Tokens to a Specific API

JWKS and RS256: Dropping the Shared JWT Secret

Intermission: What Industry Ships and Who Gets Paid

Adding OpenID Connect on Top of OAuth 2

Splitting the Auth Server from the Resource Server

Refresh Tokens and Silent Re-authentication

Using the Access Token on a Protected API

Adding PKCE to Stop Authorization Code Interception

Adding OAuth State to Stop CSRF