Menu

#IssueR

7 posts

Feed·
7 of 7 posts
Auth regression tests for CI: what to assert and why
🖼️
0

Auth regression tests for CI: what to assert and why

DEV Community·Blue Hills·29 days ago
#OGHcgFaO

Eight assertion patterns for JWT auth regression suites that catch the bugs that ship to prod. Wrong audience, expired tokens, alg=none, algorithm confusion, wrong issuer, missing claims, forged signatures, JWKS rotation drift.

15s
Read More
We rotated our JWKS without overlap. Here is the 4-minute window that broke prod.
🖼️
0

We rotated our JWKS without overlap. Here is the 4-minute window that broke prod.

DEV Community·Blue Hills·29 days ago
#aZxTOMBW
#jwt#jwks#cache#rotation#issuer#overlap

An incident narrative about a 4-minute production outage caused by a JWKS rotation with insufficient overlap. The postmortem, the fix, and the CI check that catches it before deploy.

15s
Read More
JWT verification in production: an 8-check field guide
🖼️
0

JWT verification in production: an 8-check field guide

DEV Community·Blue Hills·29 days ago
#maSWw6eI
#jwt#oidc#security#deved#token#issuer

The eight checks every production JWT verifier must do, what each one prevents, and structured error codes for each failure mode. A reference doc for backend and identity teams.

15s
Read More