User AlphaD

9 votes

Accepted

JWT: Why is audience important?

answered May 2, 2019 at 3:57

7 votes

Accepted

Why are web font resource requests not no-cors?

answered Jul 19, 2019 at 4:16

6 votes

Accepted

JWT or session cookie for API for both web and mobile app?

answered Oct 12, 2018 at 7:39

6 votes

Threema: Are received messages exposed, when sender's private key gets compromised?

answered Apr 14, 2020 at 11:05

5 votes

Is this password-less auth flow secure?

answered Nov 21, 2018 at 5:20

4 votes

I don't understand what's wrong with just using cookies for authentication?

answered Oct 16, 2018 at 4:33

4 votes

Accepted

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

answered Jan 17, 2019 at 3:31

4 votes

Magic links: JWT vs random string

answered Oct 8, 2020 at 6:45

2 votes

How will Apple and Google provide 5-minute data on Covid exposures using 10-minute interval numbers in the hash?

answered May 28, 2020 at 5:47

2 votes

unable to verify AWS EC2 Instance Identity Document with libressl

answered Nov 29, 2018 at 7:38

2 votes

New user with Chinese name appeared on MacOS. Hacker?

answered Nov 8, 2018 at 9:54

1 vote

Accepted

Firefox is uploading lots of data during startup

answered Nov 12, 2018 at 9:53

1 vote

Effects of new random Session token for each HTTP Request

answered Nov 13, 2018 at 9:52

1 vote

Accepted

How can I block access to module for Firefox? (gmail accessing camera)

answered Nov 21, 2018 at 6:12

1 vote

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

answered Dec 5, 2018 at 9:27

1 vote

Accepted

Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP?

answered Jan 31, 2019 at 6:37

1 vote

Decrypting AES-128-CBC leads to first block being correct, the rest corrupt

answered Apr 18, 2019 at 5:19

1 vote

What is the point of the payload in reset password API with JWT

answered Jan 7, 2020 at 8:01

1 vote

Accepted

OIDC: should the provider have the same address as the issuer?

answered Jul 2, 2019 at 7:21

1 vote

Accepted

Is there a downside to sending a refresh token on every request to an API?

answered Jul 28, 2021 at 7:56

1 vote

Configuration for Windows account mapped to IIS certificate authorization

answered Sep 20, 2018 at 6:42

0 votes

Accepted

Is this the correct way to use AWS Cognito?

answered Nov 5, 2018 at 3:41

0 votes

Does HTML Purifier (which converts & to &) prevent HTTP parameter pollution?

answered Nov 17, 2018 at 10:55

Stack Exchange Network

23 Answers

JWT: Why is audience important?

Why are web font resource requests not no-cors?

JWT or session cookie for API for both web and mobile app?

Threema: Are received messages exposed, when sender's private key gets compromised?

Is this password-less auth flow secure?

I don't understand what's wrong with just using cookies for authentication?

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

Magic links: JWT vs random string

How will Apple and Google provide 5-minute data on Covid exposures using 10-minute interval numbers in the hash?

unable to verify AWS EC2 Instance Identity Document with libressl

New user with Chinese name appeared on MacOS. Hacker?

Firefox is uploading lots of data during startup

Effects of new random Session token for each HTTP Request

How can I block access to module for Firefox? (gmail accessing camera)

How can a OAuth2 resource server relate an access token to the user that authorized it to prevent unauthorized access to other user resources?

Are Content-Security-Policy nonces designed for production use, or as a stop-gap when implementing a CSP?

Decrypting AES-128-CBC leads to first block being correct, the rest corrupt

What is the point of the payload in reset password API with JWT

OIDC: should the provider have the same address as the issuer?

Is there a downside to sending a refresh token on every request to an API?

Configuration for Windows account mapped to IIS certificate authorization

Is this the correct way to use AWS Cognito?

Does HTML Purifier (which converts & to &) prevent HTTP parameter pollution?