Tag archive
Supabase confirmation link fails, says 'Email link is invalid or has expired', throws 'PKCE code verifier not found', redirects to localhost or never arrives? The real causes in a Next.js app, how to tell which one you have, and the route I run in pr
A CNCF blog post argues that the 'confidential' OIDC client most on-prem clusters use for kubectl is a shared static credential in disguise, and that a public client with PKCE is the honest fit for a CLI that lives on every operator's laptop.
After Supabase OAuth sign-in, access_token and refresh_token hash fragments stay in the URL. Here is why and how to strip them with PKCE.
In Part 1 we logged in by sending a username and password directly to Keycloak. That's fine for a...
PKCE, or Proof Key for Code Exchange, is a method used to secure the authorization code flow in OAuth...
According to the Verizon Data Breach Investigations Report 2024, credential abuse was involved in 77%...
The New PKCE Authentication in AWS SSO Brings Hope (Mostly) TL;DR: Breaking tech news from Unnamed Source. What Happened 📰 Unnamed Source is rep...
Building a Google OAuth CLI in Rust with PKCE TL;DR: I built a tiny CLI that opens a...
A deep dive into RFC 7636. Thoroughly explaining the PKCE attack model, protocol details, S256 vs. plain, and security design.
OAuth 2.1 removes the Implicit Grant and ROPC flows, mandates PKCE for all clients, and enforces strict redirect URI matching. This guide covers every breaking change with production-ready migration code.
Proof Key for Code Exchange (PKCE) PKCE stands for Proof Key for Code Exchange. It is a...
How to setup authentication in Next.js using Supabase and the Auth Helpers. Now with PKCE flow!