#auth
Posts tagged #auth on Dynamo Geeks: 4 posts from the community, most useful first.
Posts tagged #auth
password reset tokens checklist: random from a CSPRNG…
password reset tokens checklist: random from a CSPRNG, single use, expire in 15-60 min, store only a hash, invalidate on password change, same response whether the email exists or not. most bugs i find are the last one
OAuth in mobile apps: use PKCE, and stop shipping client secrets in the APK
Every few months I review a mobile app that ships an OAuth client secret inside the binary. Extracting a string from an APK or IPA takes about ten minutes, so that secret is public the day the app is published. Here is the setup that actually works for native apps. Mobile apps are public clients A public client is one that cannot keep a secret: native apps, single page apps, desktop apps. The OAuth specs say so…
Where should a browser app keep its tokens? Not localStorage (mostly)
This question comes up in every code review I do for a new web app, so I am writing the long answer once. The short version For a first-party web app (your frontend talks to your own API): keep the session in an HttpOnly, Secure, SameSite cookie , and do not put long-lived tokens anywhere JavaScript can read them. If you must use OAuth access tokens in the browser, keep the access token in memory and short-lived,…