auth

2 posts.

Security & Privacy
Building auth for an app that holds health data
RS256 access tokens held only in memory, rotating refresh tokens with reuse detection, CSRF on cookie transport, TOTP with replay protection, and the gaps we have written down rather than hidden.
25 September 20264 min
Security & Privacy
One session cookie across every subdomain
Why the session cookie uses __Secure- rather than __Host-, why SameSite=Lax is enough, and the rule it forces on the whole domain.
24 September 20261 min

Building auth for an app that holds health data