Bilingual

AI Authentication and Authorization
21 days ago
- AI security relies on existing identity and authorization patterns from the API boom.
- Three AI use cases discussed: RAG, tool use (MCP/APIs), and agentic systems.
- RAG requires authorization to filter documents before they reach the LLM.
- Tool use involves controlling AI access to APIs and services via authentication methods like OAuth 2.1.
- Agentic systems need a chain of identity to track human authorization through workflows.
- Deterministic identity enforcement is crucial for probabilistic AI systems.
- FusionAuth examples illustrate implementation with fine-grained authorization and audit logging.
Better Auth is joining Vercel
18 days ago
- Better Auth is joining Vercel, combining forces to advance auth solutions with a focus on open-source, framework-agnostic approaches and exploring agent security in AI-driven workflows.
- The founder built Better Auth after experiencing challenges with existing auth tools like NextAuth, leading to the creation of a framework-agnostic auth framework that gained community traction.
- Better Auth became a company after joining Y Combinator, raising capital, and later acquiring Auth.js/NextAuth.js to enhance its offerings and community reach.
- Future plans include advancing Better Auth's mission with Vercel's support, developing Agent Auth for secure agentic workflows, and continuing open-source contributions without monetization pressures.
You shouldn't trust Trusted Publishing
18 days ago
- Trusted Publishing is an authentication scheme for machine-to-machine trust, not for human trust in package safety.
- It uses OIDC to link CI/CD machine identities to package indexes, issuing short-lived, scoped publishing credentials.
- PyPI avoids displaying Trusted Publishing status prominently to prevent misuse as a trust signal for package quality.
- Trusted Publishing reduces long-lived credentials but can still be compromised if CI/CD workflows are attacked.
- The scheme is optional and does not guarantee package safety; anyone can use it, including for malicious uploads.
- Attestations on PyPI are separate from Trusted Publishing and also do not imply end-user trust without independent verification.
What's the best way to do authentication in modern applications
15 days ago
- JWTs are commonly used for authentication but storing them in localStorage makes them vulnerable to XSS attacks, as any JavaScript on the page can read localStorage.
- Using HTTP-only cookies with flags like Secure and SameSite=Lax prevents JavaScript from reading tokens, reducing the risk of token exfiltration during XSS attacks.
- CSRF attacks are a risk with cookies, but can be mitigated using CSRF tokens, SameSite attributes, and checking request headers like Origin or Sec-Fetch-Site.
- Stateless JWTs have revocation issues; server-side sessions with opaque session IDs in HTTP-only cookies allow immediate session invalidation and are more secure for single applications.
- For OAuth or third-party tokens, use a Backend for Frontend (BFF) pattern where tokens are stored server-side, and the browser only holds an HTTP-only session cookie, preventing token exposure to JavaScript.
- Refresh token rotation and reuse detection enhance security by invalidating stolen refresh tokens and forcing re-authentication.
- Device Bound Session Credentials (DBSC) bind sessions to hardware, preventing stolen cookies from being used long-term, though adoption is currently limited.
- For React applications, centralize token handling in an API wrapper to manage token refresh and prevent concurrent refresh requests from causing logout.

authentication

AI Authentication and Authorization

Better Auth is joining Vercel

You shouldn't trust Trusted Publishing

What's the best way to do authentication in modern applications