5 verified briefings on Authentication. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
Norway's national digital identity system is facing a systemic crisis, creating significant problems for citizens and businesses. The failure highlights critical lessons for building resilient digital infrastructure, especially concerning reliance on private providers and a lack of public oversight.
A security researcher discovered that adding a trailing slash to AWS HTTP API paths could bypass Lambda authorizer authentication entirely. This critical vulnerability, caused by a path normalization mismatch, enabled unauthorized actions, including wire transfers at a fintech company, highlighting a significant security risk.
Multi-factor authentication (MFA) is being defeated by a simple tactic. Attackers with stolen credentials spam users with login approval requests, hoping to trick them into granting access out of confusion or fatigue. This method bypasses a core security protection without stealing the second factor.
Multiple critical vulnerabilities have been found in Casdoor, an open-source identity and access management platform. Versions 2.362.0 and earlier are affected. The flaws allow attackers to bypass authentication, escalate privileges, and impersonate users by exploiting issues in its core security mechanisms.
A new guide shows developers how to build Web3 wallet authentication using Python's FastAPI and Web3.py. The method replaces traditional passwords with cryptographic signatures, detailing a flow from nonce generation and user signing to signature verification and issuing JSON Web Tokens (JWT) for secure access.