Skip to main content

#oauth

Log entries with this tag, newest first.

  1. Decision recordIdentity and access

    Mutual TLS and certificate-bound tokens for the links that matter

    Client credentials alone let a token travel. For the links between a site and its cloud, and between an assistant's tool servers and the API, every token is bound to the client's certificate (RFC 8705), tokens are exchanged instead of forwarded (RFC 8693), and resources announce their issuer (RFC 9728). The decision record, with the parts that only building it revealed.

    8 min read

  2. Decision recordIdentity and access

    A Content Security Policy for an identity server

    The strictest policy a sign-in page can carry, which directive is left out and why, what base-uri 'none' does to a Blazor page, and why the policy is chosen from the endpoint. A design note from building Hexavera's identity host.

    6 min read

  3. Decision recordIdentity and access

    One identity server for the cloud and for every site

    When the same product runs in the cloud and at customer sites, identity is part of the product, so one identity host on OpenIddict and ASP.NET Core Identity serves both. The decision record: the model, the values, the options rejected, and what it costs.

    8 min read