Authentication
JWT, OAuth, sessions and the token mistakes that hand over accounts.
14 articles
kubectl Unauthorized on EKS: Check the IAM Identity, Not RBAC
EKS returns Unauthorized when it cannot map your IAM principal to a Kubernetes user, so no ClusterRoleBinding will fix it. Here is the diagnosis order that actually resolves it.
Storing JWTs in localStorage Turns Any XSS Into Account Takeover
Every JWT tutorial puts the token in localStorage. Here is what that costs when XSS lands, and the in-memory access token plus HttpOnly refresh cookie setup that replaces it.
Users Randomly Logged Out: Fixing next-auth Token Rotation
Auth.js refresh token rotation silently drops the rotated token in four distinct ways, and the popular workaround of disabling rotation is worse than the bug. Here is the real fix.
Dynamic Code Evaluation Not Allowed in Edge Runtime: The Next.js Middleware Fix
Mongoose and jsonwebtoken break Next.js middleware with a dynamic code evaluation error that names no package. Here is the real cause and the fix for each version.
Auth.js v5 redirects to the wrong URL behind a reverse proxy
Set NEXTAUTH_URL and it still redirects to localhost or the container IP. In v5 the host comes from proxy headers gated by trustHost, and that is the real fix.
IP Rate Limiting Won't Stop Credential Stuffing: What Actually Does
Distributed credential stuffing rotates thousands of IPs, each trying once, sliding under every per-IP limit. Here is the per-account, breached-password and MFA stack that stops it.
x509 Certificate Signed by Unknown Authority on the ingress-nginx Admission Webhook: The Real Fix
An x509 trust error on the ingress-nginx or cert-manager admission webhook blocks every Ingress cluster-wide. The cause is a drifted caBundle. Patch it, do not delete the webhook.
JWTs Have No Logout: Adding Expiry and Revocation Without Losing Statelessness
A JWT you cannot revoke is a password you cannot change. How to add real logout, short-lived access tokens and a revocable refresh token without throwing away statelessness.
JWT alg:none and RS256/HS256 Confusion: Pin Your Algorithms
A JWT verifier that reads the alg header from an untrusted token is not verifying anything. How alg:none and the RS256-to-HS256 swap work, and the pinning fix in five languages.
useSession() Only Updates After a Manual Reload in the Next.js App Router
NextAuth useSession() stays stale until you reload because the App Router has two session reads. Here is why router.refresh() only fixes half, and the reliable pattern.
FastAPI Cross-Site Cookies Silently Not Set: SameSite and Secure
Your FastAPI set_cookie returns 200 but the browser never stores it and there is no error. Here is why cross-site cookies need SameSite=None; Secure, and how to fix it.
A Valid JWT Signature Isn't Enough: Check the aud and iss Claims
A valid JWT signature proves who issued the token, not who it was for. Without aud and iss checks, one service's token works against another. Here is the fix.
Multi-tenant next-auth: fixing NEXTAUTH_URL without disabling host checks
NEXTAUTH_URL is a single value read once at boot, so multi-domain apps redirect to the wrong host. The workaround everyone posts reopens host-header injection. Here is the safe pattern.
Postgres 'no pg_hba.conf entry for host': the scoped fix, not 0.0.0.0/0
The FATAL: no pg_hba.conf entry error has a two-minute fix that also opens your database to the whole internet. Here is the scoped rule to add instead.