You're viewing the readable version of this site. The interactive extras (search, diagrams, read-aloud) need JavaScript and a current browser. Enable JavaScript; if it is already enabled, update your browser.

Tag

Notes tagged “jwt”

Every note filed under jwt, newest first.

A filtered view of the notes.

2026

  1. One Defect, Three Surfaces

    CORS allowlists, OAuth redirect URIs and open redirects have separate vulnerability literatures and the same bug — a structured identifier tested with a string operation. The fix is one sentence, and a standards body finally wrote it down.

    security web oauth jwt sessions authentication dissecting-systems