Topic
SHA-256
Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories
Supply Chain & Open Source
Hash Functions Part 1: Core Properties, Security Requirements and Practical Applications
Other
Bcrypt Password Hashing Silently Ignores Characters Beyond 72 Bytes, Breaking Verification Expectations
Vulnerabilities & ExploitsPilcrow Publishes Free Comprehensive Guide on Web Authentication
Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.
Spring Security Tutorial Details Refresh Token Implementation to Complement JWT Authentication
A detailed technical guide explains how to enhance JWT-based authentication in Spring Security by introducing refresh tokens for improved security and user experience. The article covers the creation of a RefreshToken entity stored in the database, along with repository and service layers that handle token generation, verification, revocation, and rotation using UUID and expiration timestamps. It discusses security advantages such as short-lived access tokens combined with long-lived refresh tokens hashed via SHA-256 or HMAC-SHA256, while also addressing risks including database theft and XSS attacks mitigated by HttpOnly cookies. Code examples demonstrate updates to AuthService, AuthController, and SecurityConfig to support registration, login, token refresh via cookies, and logout functionality. Additional best practices include automatic token rotation on refresh and session management across multiple devices. The tutorial emphasizes minimizing credential transmission over networks while maintaining stateful token validation.