Knowledge
Security
Authentication across services, browser security headers, and what each protection does and does not cover.
Security
Single Sign-On Across Subdomains: How One Login Works for Many Products
A practical guide to giving several web products one login with OAuth 2.0 and OpenID Connect — a central identity provider, PKCE, short-lived signed tokens — and the trade-offs to plan for.
Read article
Security
HTTP Security Headers Explained: CSP, HSTS, Framing and nosniff
What each common security header defends against, sensible starting values, how to roll out a Content Security Policy without breaking a site, and how to check what you actually send.
Read article