Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Explore our questions

18 votes
3 answers
4k views

Is there a problem with having a combined login/register screen?

0 votes
1 answer
502 views

AWS Service-To-Service authentication via Identity document

1 vote
1 answer
564 views

Should login/refresh authentication routes return new tokens if an existing, valid token is present?

0 votes
2 answers
117 views

"Duplicate" of Chrome Tabs causes stale tokens

0 votes
1 answer
785 views

security concerns when configuring Windows 10 to automatically log into a Microsoft account-linked user account

3 votes
1 answer
2k views

How to interpret a Google "Someone is trying to sign in to your account from another device" message?

3 votes
1 answer
844 views

Is passing claims about the user in an access token "abusing" OpenID Connect?

5 votes
3 answers
11k views

What is a AUTH-KEY in the security of the computers?

0 votes
1 answer
36 views

How to verify the salt in the SCRAM protocol?

33 votes
4 answers
5k views

How is "something you have" typically defined for "two-factor" authentication?

426 votes
5 answers
562k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

1 vote
5 answers
206 views

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

2 votes
1 answer
349 views

Possible public/private identity recovery after compromise without a centeral authority?

1 vote
4 answers
257 views

Anything particularly wrong with putting an auth code in marketing emails?

Browse more Questions