Newest first, grouped by year. Search or filter by topic.
Of eight JWT keys in the README's flagship example, four bind to nothing, three restate defaults and one has any effect - and the last edit to that README came ten minutes before the commit that invalidated it.
The README and the sample both configure an auth claims alias map, the configuration class has no such property, and the binder's ignore-unknown-keys behaviour is what makes the omission silent.
Pacco's Identity service fits its whole auth machinery - JWT issuance, a refresh-token aggregate, Redis deny-list revocation - in about fifteen files, and most of them are right. The three that aren't teach more - a mapper bug that leaves 202 callers polling forever, a dead password check, and a refresh token that never rotates.
DShop puts all its authorization at the gateway and none in the services behind it - then publishes every service port to the host. The compose file quietly defeats the entire security model.
The Identity service gets the hard parts of auth genuinely right - issue, refresh, revoke - and then commits its signing key to source control and ships a CORS policy the spec forbids. Part 13 of Nine Services and a Message Bus.
DShop.Common makes a stateless JWT revocable with a Redis deny-list and a per-request round-trip - plus an iat claim in milliseconds and two validators that disagree.
Convey's auth packages in two acts - a JWT layer that turns one config section into token issuing and validation, and the uncomfortable question every stateless system meets on logout day.
The FastEndpoints.Security package covers the token lifecycle end to end - creation with symmetric or RSA keys, an abstract refresh-token service that is secretly an endpoint, and a revocation middleware that makes you pay the lookup tax honestly. Part 8 of FastEndpoints in Depth.
