标签：#auth

Short answer: Retry the transport operation, never the OAuth meaning: keep one durable authorization attempt, accept its callback once, and make every downstream effect replayable from recorded state. For a B2B SaaS account-deletion flow, I would block new sessions before attempting remote cleanup, because deleting data while a surviving session can still act is the more dangerous ordering. That is the architecture decision. It treats a timeout as missing knowledge, not proof of failure. A callback may have committed even when the browser received no response; a token exchange may have reached the other side even when the connection closed; an account deletion may be retried by a worker after its first lease expires. The recovery design must therefore answer a narrow question at each boundary: do we know the operation did not happen, do we know it happened, or is the result still unknown? What must remain true during OAuth failure recovery? The first invariant is that an authorization attempt has one identity independent of any HTTP request. Store an opaque flow identifier, the expected callback state, the account or tenant context, a creation time, an expiry, and a small state machine such as pending , exchanging , succeeded , or failed . Don't let a browser refresh create a second logical attempt merely because it creates a second request. The second invariant is single consumption. An authorization code and its state belong to one attempt; the callback handler must atomically claim that attempt before triggering side effects. A duplicate callback should read the previously recorded outcome and return the same application-level destination. It must not provision the user again, issue another internal session, or append a second audit event that claims a second login. Exactly once is the goal, but HTTP cannot promise it by itself, so I use an exactly-once mindset at the business boundary: an atomic database transition establishes who owns the work, unique constrain

Short answer: use an emailed, single-use reset link as the default for most SaaS login recovery, and add SMS OTP only where users may genuinely lack email access or the product already maintains verified phone numbers. Email is usually the simpler system because the login identifier, recovery destination, and support workflow can remain in one channel. SMS can shorten the interaction, but it adds phone-number lifecycle, message segmentation, regional consent, and delivery-state work. “Cheaper” depends on your traffic and failure rates, so model completed recoveries rather than message sends. This is a recovery decision, not a notification preference. The goal is to return the right person to an account without turning a delayed message, an expired credential, or a recycled phone number into an account takeover or a support queue. I've worked around enough spam filtering, rate limiting, and OTP delivery gaps to treat the channel as one component of that system — never as the system itself. What should a SaaS password recovery flow use: email API or SMS OTP? Start with the account data you can already trust. If every user signs in with an email address and changing that address is a controlled operation, an email reset link creates the smaller data surface. The service generates a high-entropy, single-use token, stores only a protected representation of it, sends a link, and accepts that token once before a short expiry. The browser then moves the user into a password-change session. An SMS OTP flow looks compact on screen, yet the backend has more questions to answer. Was the phone number verified recently? Can the user update it without being signed in? How are country codes normalized? What happens when a number is reassigned? Does the support team have a safe path for a person who lost the device? A six-digit form doesn't make those policy decisions disappear. So the default is straightforward. Choose email first when email is the stable account identifier and rec

Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.

If you ship email validation with CakeDC/Users , you eventually hit a question the plugin quietly hands back to you: what should happen when someone registers, never clicks the validation link, and then tries to log in? The honest answer is that CakeDC/Users doesn't decide for you. Out of the box you get a database column, a couple of behaviors, and a set of events — but the experience is yours to assemble. Get it wrong and you land in one of two bad places: a user silently logged in without ever validating, or a user who typed the right password and is told "username or password is incorrect." Neither is what you want. This post walks through why that happens in v16, and a clean way to wire the flow using the events the plugin already dispatches — no core hacks, no schema surgery. One flag, two meanings Everything starts with a single boolean column on the users table: active . When email validation is on, registration creates the account with active = 0 and only flips it to 1 when the user clicks the link in the validation email. You can trace it in BaseTokenBehavior::_updateActive() : // $user['validated'] is a transient flag set to false during register() $emailValidated = $user [ 'validated' ]; if ( ! $emailValidated && $validateEmail ) { $user [ 'active' ] = false ; // registered → inactive + token emailed $user -> updateToken ( $tokenExpiration ); } else { $user [ 'active' ] = true ; // clicked the link → active $user [ 'activation_date' ] = new DateTime (); } Notice there is no separate validated column in the database — $user['validated'] is a transient property used only during registration. The persisted truth is active , and it is doing two jobs at once: "Has this person confirmed their email?" — set by the validation flow. "Is this account enabled?" — the thing an admin toggles to ban or suspend someone. That conflation is the root of everything below. Hold onto it; we'll come back to it. How the finder decides who exists Login in CakeDC/Users runs thro

TL;DR: Most Laravel apps hit the same 5 authorization walls as they grow — role explosion, exception handling, multi-tenancy, contextual permissions, and debugging nightmares. This deep dive shows how to solve each one with modern patterns, and introduces a package that combines all solutions: Laravel Permission Manager . 🔗 GitHub · 📦 Packagist 📋 Table of Contents Introduction: The Authorization Ceiling Problem #1: The Role Explosion Trap Problem #2: The "Except This One" Problem Problem #3: The Multi-Tenant Nightmare Problem #4: The "Can They Edit THIS Post?" Problem Problem #5: The Silent Cache Bug Bonus: The 3 AM Debugging Nightmare The Complete Solution Real-World Implementation Comparison with Spatie Final Thoughts 🎯 Introduction: The Authorization Ceiling Every Laravel project starts with the same authorization story: // Day 1: Simple and beautiful if ( $user -> is_admin ) { // show admin stuff } By month three, it looks like this: // Month 3: Starting to hurt if ( $user -> hasRole ( 'admin' ) || ( $user -> hasRole ( 'editor' ) && $post -> status === 'draft' ) || ( $user -> hasRole ( 'manager' ) && $post -> department_id === $user -> department_id )) { // ... } By year one, you've got authorization logic scattered across controllers, policies, middleware, and blade templates — with no clear source of truth. This is what I call "The Authorization Ceiling" : the point where basic RBAC stops working and you need something more sophisticated. In this article, we'll explore the 5 most common authorization problems Laravel developers hit, why traditional solutions fail, and how modern patterns (and modern packages) solve them cleanly. 🔴 Problem #1: The Role Explosion Trap The Symptom Your application has roles: admin , editor , viewer . Life is good. Then the product team asks: "Can we have an admin who can't delete users?" "Can we have an editor who can publish but not delete?" "Can we have a viewer who can export reports?" Before you know it, you have 47 roles in

Passkeys are still safer than passwords. That is the answer, and the research behind the scary headlines says so too. On 3 August 2026, Palo Alto Networks' Unit 42 published three techniques that let malware take over accounts protected by Google-synced passkeys. No fingerprint, no PIN, and no prompt on screen. The coverage that followed skipped the part readers need: exactly who is exposed, and what to change. The real scope is narrow. The fix is cheap. The standard itself is not broken. What Pass-ta-key actually is A passkey is a key pair that replaces a password. The private half stays on your device or in a synced store, and the site only ever sees a signature. Unit 42 named three variants, not four. Several outlets reported a fourth, including 9to5Google . The research describes three ( Unit 42 , 3 August 2026). Pass-ta-key. Malware extracts Chrome's device identity key and uses it to sign a request. No admin rights, no device unlock, no user action. Silver Pass-ta-key. The attacker forces Chrome to re-register the device. They then register their own user-verification key with Google's cloud authenticator. Afterwards they can sign in from their own machine, and the cloud authenticator believes a fingerprint check happened. Golden Pass-ta-key. The attacker pulls the Security Domain Secret out of Chrome's process memory during onboarding. The Security Domain Secret is a 32-byte master key that protects every synced passkey. With it, they all decrypt. This is the variant that turns one infection into a saleable bundle ( BleepingComputer , 3 August 2026). The target is not the passkey file on disk. It is the Google Cloud Authenticator behind Google Password Manager, and the trust it puts in a device that malware is now imitating ( The Hacker News , August 2026). Who is actually affected This is the question the coverage left open. Here it is against the research's own stated scope. Setup Status Chrome on Windows with a TPM, Google Password Manager Affected. This i

A Reddit thread on connecting Claude Code to a Yahoo Mail account turned into a solid field guide for scoping down what an AI agent is allowed to touch. Here's the distilled version. Don't give Claude Code your Yahoo password or unrestricted mailbox access. The risk isn't only the password leaking, it's that an agent with full access can read private messages, attachments, recovery details, and information about other people, all in the course of doing something mundane. Why "just connect it" is the wrong instinct The thread's most-quoted line frames the problem well: people are casually handing agents the keys to everything at once. People are talking about just giving ai agents access to their entire devices LOL. Emails, passwords, bank accounts like what. The concern isn't that the agent will maliciously steal your data, it's that broad access creates exposure you didn't intend, every time the agent reads something to complete an unrelated task. The issue isnt really theft its exposure. And exposure scales with trust you've already granted, not with anything going wrong: It's all based on trust. Safer ways to connect it 1. OAuth over password Use a connection method where Yahoo shows you exactly what's being requested and lets you revoke it later. Never type your Yahoo login directly into the agent. 2. Least access, read-only Point it at a separate, low-value mailbox if you can. Avoid granting send, delete, forward, or account-settings permissions; the agent shouldn't be able to act as you. 3. Keep credentials out of the agent The safer pattern is a credential vault the agent calls out to, so it can request an authenticated action without ever seeing the raw secret. Before you connect anything ✅ Strip sensitive mail first. One commenter's habit: swap real details for placeholders and dummy data, then substitute the real values back in once the model's output comes back. ✅ Use a throwaway or secondary account. Never connect the address tied to banking, password re

The mental model that fixes everything JWT is just a token format . It is not authentication, not a session, and not a database. Once you separate those ideas, most of the pain disappears. A JWT is a JSON object that is signed. That's it. The payload holds claims like sub (subject) and exp (expiration). The signature proves the token wasn't tampered with. What JWT is not Not a session store : You can't revoke a JWT before it expires. If you need revocation, you need a blocklist or short expiry. Not a database : Don't stuff heavy data in the payload. It gets sent on every request. Not a magic bullet : It's a way to pass claims between parties without a shared server-side state. The three flows that matter 1. Access token only Simplest flow: login returns a JWT, client sends it in the Authorization header, server verifies it on every request. // server middleware (Express example) const jwt = require ( ' jsonwebtoken ' ); function auth ( req , res , next ) { const header = req . headers . authorization ; if ( ! header ) return res . status ( 401 ). json ({ error : ' No token ' }); const token = header . split ( ' ' )[ 1 ]; // Bearer <token> try { req . user = jwt . verify ( token , process . env . JWT_SECRET ); next (); } catch ( err ) { res . status ( 401 ). json ({ error : ' Invalid token ' }); } } Works fine for small apps, but every request hits your auth logic and the token can't be invalidated early. 2. Access + refresh token Common pattern for SPAs. Access token lives 15 minutes, refresh token lives 7 days. The refresh token is stored securely (httpOnly cookie) and used only to get a new access token. // issue tokens on login const accessToken = jwt . sign ({ userId }, process . env . JWT_SECRET , { expiresIn : ' 15m ' }); const refreshToken = jwt . sign ({ userId }, process . env . REFRESH_SECRET , { expiresIn : ' 7d ' }); res . json ({ accessToken }); res . cookie ( ' refreshToken ' , refreshToken , { httpOnly : true , secure : true , sameSite : ' strict ' })

ReBAC (relationship-based access control) decides access based on how entities are connected to each other, rather than on a role attached to the user. Nowhere is it written that you can see that repository. You see it because a chain of relationships leads you there. It's a model I like, and I want to say that up front, because what follows isn't a criticism of ReBAC. I spent a few weeks integrating OpenFGA into a prototype to use it properly: declarative model, sixteen test scenarios, a hundred and twenty assertions running offline in two seconds with no database and no application. It worked well. I removed it anyway. Not because of a bug, and not because of check latency. I removed it because none of the tools I tried gives me a usable answer to the second question every application asks. The check is fast. The list isn't. "Can this user see this object?" resolves in milliseconds. The problem is that the first screen after login is almost always a list. And "which objects can this user see?" looks like the same question reversed, but it isn't: nowhere is it recorded which objects are reachable, which is the point of ReBAC seen from the other side. In the first case you hold two things and walk the graph from one to the other. In the second you hold only the user, and the set of possible answers is everything that exists in the system. Three routes, and where each one stops Filter afterwards. Normal query with its normal pagination, then you send the twenty-five ids to the service and drop the ones that don't pass. The result is correct, but the total at the bottom of the page is the one from before the filter, so it's a lie. And the user with access to a small slice gets three rows out of twenty-five. Filter first. You ask the service which objects the user holds that permission on and hand them to the database. Except the list arrives whole. There's no real pagination to draw twenty-five from. It ends up as an IN with thousands of identifiers. A local index. Yo

Why passkey apps treat Windows differently than other operating systems.

You're debugging a broken SSO login. The identity provider (IdP) redirects back to your app, and somewhere in the request is a big blob called SAMLResponse . You grab it, Base64-decode it, and expect to see clean XML. Sometimes you do. Sometimes you get binary garbage that starts with bytes like 0x78 0x9c and looks nothing like markup. Both outcomes are correct. The difference is which SAML binding the IdP used, and once you know the two encoding chains, SAML debugging stops being guesswork. The two bindings, and their two encodings SAML sends its messages ( SAMLResponse , SAMLRequest ) using one of two HTTP bindings, and they encode the payload differently: HTTP-POST binding — the message rides in a hidden form field that auto-submits via POST. The value is simply: Base64(XML) Decode the Base64 and you get the assertion XML directly. This is the common case for the response coming back from the IdP. HTTP-Redirect binding — the message rides in a URL query string, so it has to be small and URL-safe. The value is: URLEncode( Base64( DEFLATE( XML ) ) ) That's three layers. If you only Base64-decode it, you're staring at the raw output of a DEFLATE compressor — which is exactly the binary garbage people report. This binding is typically used for SAMLRequest (the AuthnRequest your app sends to the IdP) and for Single Logout. Critically, the redirect binding uses raw DEFLATE (RFC 1951) with no zlib header and no checksum . That's the single most common thing people get wrong — they reach for a normal zlib/gzip inflate, it chokes on the missing header, and they conclude the blob is corrupt. It isn't; it just needs a raw inflate. Decoding both in Python import base64 import zlib from urllib.parse import unquote # --- HTTP-POST binding: Base64(XML) --- def decode_post ( saml_response : str ) -> str : return base64 . b64decode ( saml_response ). decode ( " utf-8 " ) # --- HTTP-Redirect binding: URLEncode(Base64(DEFLATE(XML))) --- def decode_redirect ( saml_param : str ) -> s

When Anthropic introduced the Model Context Protocol on November 25, 2024, it got everyone's eyes on it, including Christy, who was Appwrite's Engineering Lead back then. I had just started my role as an "Engineering Intern" and had no idea what a whole new protocol meant, or why it was such a big deal. Looking at the surface, I wasn't entirely wrong. MCP is JSON-RPC with a schema and a handshake stapled on. What took us sixteen months was everything stapled around it. Streamable HTTP did not exist when MCP launched. It replaced HTTP+SSE in the 2025-03-26 revision. The stdio years Christy had a working stdio server in the repo by February 26, 2025. We already had API keys, so the wiring was simple: claude mcp add appwrite \ --env APPWRITE_PROJECT_ID = <YOUR_PROJECT_ID> \ --env APPWRITE_API_KEY = <YOUR_API_KEY> \ --env APPWRITE_ENDPOINT = https://cloud.appwrite.io/v1 \ -- uvx mcp-server-appwrite An API key is scoped to exactly one project by design, so the ceiling was baked into the credential. Switching projects meant editing your editor config. Creating a project was impossible. So was anything at the organization level. The credential is the whole difference between the two transports, and everything hard about the hosted version follows from swapping it for a token that belongs to the user instead of the project. Authorization ate the schedule By the spec, authorization is genuinely optional: Authorization is OPTIONAL for MCP implementations. [...] Implementations using an HTTP-based transport SHOULD conform to this specification. For a service where one tool call can drop a database, we weren't comfortable treating it as optional. If you use Auth0 or WorkOS, this is a config screen. Appwrite keeps everything in-house, so Matej built the authorization server itself, and I built the resource server plus whatever Cloud was still missing before real clients would work. Steps 2 through 6 are the part that makes "just paste this URL" work. Nothing is pre-provisioned.

A hands-on guide to being your own Identity Provider — with Laravel 12 and Passport v13. You will build a Central Portal that acts as an OAuth 2.0 Authorization Server, then wire up child sites ( Site A , Site B , Site C ) so a user logs in once and gets access to all of them. No Google. No Auth0. No Keycloak. No "Sign in with…" anything. You own the users table, you issue the codes and tokens, you hold the signing keys. The only dependency is laravel/passport , which implements the OAuth 2.0 protocol machinery — every identity decision is yours to make, and this guide walks through each one. The scope is deliberately narrow: authentication only. How a user proves who they are at a central server, and how a child site learns that identity. Everything else (admin CRUD screens, audit logging, UI theming) is left out. Everything here is buildable on a fresh Laravel install. No prior context needed. Table of Contents What We Are Building OAuth 2.0 Foundations System Architecture Authentication Workflows Part A — Building the Central Portal Part B — Building a Child Site Registering a Child Site End-to-End Testing Gotchas & Security Notes Reference Tables Appendix A — Extending to Multiple User Types Appendix B — Mental Model in One Page 1. What We Are Building The Problem You operate several web applications. Each has its own users table, its own login form, its own password reset flow. When a staff member joins, someone creates four accounts. When they leave, someone must remember to disable four accounts. Passwords drift out of sync. There is no single place to answer "who has access to what?" The Solution One central server owns identity. Every child site delegates login to it. ┌─────────────────────────────┐ │ Central Portal │ │ ┌───────────────────────┐ │ │ │ admin.portal.test │ │ Management UI │ │ │ │ — create users │ └───────────────────────┘ │ — grant per-site access │ ┌───────────────────────┐ │ │ │ sso.portal.test │ │ OAuth 2.0 endpoints │ │ (authorization ser

This article describes an anonymized enterprise implementation. Company names, internal domains, repository identifiers, ticket numbers, and proprietary control names have been intentionally removed or generalized. Multi-factor authentication is often described as a login problem: enter a password, receive a code, confirm identity. That model was not enough for the system described in this case study. The product ran in an in-store environment where the same tablet could be used by several people during a transaction: an employee initiating the process; a manager approving or supporting it; a customer reviewing and signing on their own device. The challenge was not simply to prove that a user knew a six-digit code. We needed to create a secure, short-lived handoff between a shared in-store session and the customer’s personal phone, without leaking the downstream signing session or allowing multiple devices to claim the same transaction. This post explains the architecture, the security model, the trade-offs, and the production practices behind that platform. The actual problem: secure device handoff The workflow started on a shared tablet. At a certain point, the customer needed to continue part of the process on their own phone. The platform therefore had to answer several questions: How does the phone prove that it belongs to the customer currently standing in front of the employee? How does the shared tablet know that the correct phone claimed the correct session? What happens if the QR code is scanned twice? How do we prevent session identifiers and tokens from appearing in URLs, browser history, logs, or referrer headers? How do we notify the phone immediately when verification succeeds? How do we ensure that a single-use signing URL is never exposed before verification? Those constraints turned a seemingly small MFA feature into a distributed-system problem involving identity, real-time communication, concurrency, edge delivery, infrastructure, and operational

I went looking for a simple answer to a simple question: How do you give an agent access to Google Calendar? Not a demo. Not a screenshot. A real agent, running unattended, with enough access to be useful and enough guardrails that it won’t turn into a security incident. While researching OpenClaw setups, I found a thread on r/openclaw where someone asked what looked like a tiny question: what do I need to add Google Calendar to OpenClaw? One reply said: "Look into gog cli." That answer is way more revealing than it looks. Because the hard part usually isn’t Google Calendar itself. The hard part is everything hidden behind the phrase "connect Google" . And if you’re building agents in n8n, Make, Zapier, OpenClaw, or a custom OpenAI-compatible loop, auth is only half the problem anyway. Once the workflow runs 24/7, you also need to think about retries, quota limits, caching, and how many LLM calls the thing is quietly making in the background. That’s where a lot of teams hit the same wall: the integration works, but the operational shape of it is bad. Security is fuzzy. Request volume is noisy. And AI costs get weird fast if every poll and retry triggers more model calls. The demo version is lying to you If you’ve used something like n8n Cloud, you’ve seen the polished version: Click Google Calendar Sign in Approve access Done That flow is real inside a managed product. But the minute you leave the managed garden — self-hosted n8n, OpenClaw, a custom MCP server, a Python worker on Ubuntu, or your own app using the OpenAI SDK against an OpenAI-compatible endpoint — you inherit the boring parts. Now "connect Google" actually means: create a Google Cloud project configure the OAuth consent screen choose the right OAuth client type enable the Google Calendar API pick the right scopes store credentials safely handle refresh tokens deal with quota errors later That’s not setup trivia. That’s infrastructure. One user in that same OpenClaw discussion realized it immediately:

Harrowing story of an identity theft victim. Yes, the person made a mistake—they gave the scammer a two-factor authentication code that allowed the scammer to take over their email address. But the real story here is how, for many of us, the security of most of our accounts hangs on the security of our email accounts.

YouTube has updated its monetization policies to more clearly define the kinds of AI-generated and low-quality videos that can’t earn ad revenue.

Toute équipe qui développe un logiciel B2B se heurte au même carrefour la première fois qu'un client sérieux annonce « il nous faut le SSO ». Deux acronymes, OIDC et SAML, prétendant chacun être la réponse, et un internet rempli de tableaux comparatifs qui vous disent que SAML est « entreprise » et OIDC « moderne », pour vous laisser exactement aussi coincé qu'avant. Voici la version qui vous aide vraiment à livrer. Ce qu'ils sont SAML date de 2005 et c'est du XML. Un fournisseur d'identité signe une assertion (« voici alice@bigco.com , voici ses groupes ») et la transmet à votre application, qui vérifie la signature et la connecte. Il a été conçu pour le navigateur et pour l'identité des collaborateurs, à une époque où « l'entreprise » signifiait un Active Directory sur site et une pile SOAP. Il est verbeux, il est ancien, et il est absolument partout au sein des grandes organisations, ce qui est le seul fait le concernant qui compte pour vous. OIDC date de 2014 et c'est du JSON et des JWT, posés sur OAuth 2.0. Un fournisseur d'identité émet un jeton d'identité que votre application valide. Il a été conçu pour le web moderne : SPA, applications mobiles, API, connexion sociale. Il est plus propre, mieux spécifié pour ce que vous construisez réellement aujourd'hui, et c'est le protocole que parle désormais la plupart des nouveaux projets d'identité. Quand chacun l'emporte La réponse honnête à « lequel dois-je développer » est que vous n'avez presque jamais le choix. Vous développez celui qu'a choisi le service informatique de votre client, et il l'a choisi bien avant d'avoir entendu parler de vous. Un client sous Okta, Entra ID ou Google Workspace peut généralement faire l'un ou l'autre, et OIDC est la voie la plus agréable. Un client sous un ADFS plus ancien, un IdP historique sur site ou une grille d'achat rédigée en 2016 vous remettra un bloc de métadonnées SAML et une invitation à un rendez-vous, et la discussion s'arrête là. Vos propres applications maison, votr

每一个开发 B2B 软件的团队，都会在第一次有正经客户说出"我们需要 SSO"时撞上同一个岔路口。两个缩写，OIDC 和 SAML，都自称是答案，而满网都是对比表格告诉你 SAML 是"企业级"、OIDC 是"现代化"，然后把你撂在原地，跟之前一样毫无头绪。这里给你一个真正能帮你交付的版本。 它们是什么 SAML 来自 2005 年，本质是 XML。身份提供方对一份断言签名（"这是 alice@bigco.com ，这是她所属的群组"），然后把它发送给你的应用，应用校验签名并让她登录。它是为浏览器和员工身份场景而生的，那个年代的"企业"意味着本地部署的 Active Directory 和一套 SOAP 技术栈。它冗长、它老旧，而且在大型组织内部无处不在——这才是关于它你唯一需要在意的事实。 OIDC 来自 2014 年，本质是 JSON 和 JWT，构建在 OAuth 2.0 之上。身份提供方签发一个 ID 令牌，由你的应用来校验。它是为现代 Web 而生的：SPA、移动应用、API、社交登录。它更简洁，对你今天真正在构建的东西有更完善的规范，也是如今大多数全新身份方案所使用的协议。 各自何时胜出 对于"我应该构建哪一个"这个问题，老实的答案是：你几乎从来没有选择权。你构建的是你客户的 IT 部门选定的那一个，而且他们早在听说你之前就已经选好了。 一个使用 Okta、Entra ID 或 Google Workspace 的客户通常两种都能用，而 OIDC 是更舒服的那条路。 一个用着老版 ADFS、某个遗留的本地部署 IdP，或一份写于 2016 年的采购清单的客户，会扔给你一堆 SAML 元数据和一封日历邀请，讨论到此为止。 你自己的第一方应用——你的仪表盘和你的移动客户端——要的是 OIDC，没有例外。你绝不会为了让用户登录进你自己的 React 应用而去搬出 SAML。 于是局面清晰地一分为二：现代场景和第一方场景用 OIDC，"因为企业方这么要求"的场景用 SAML。卖给足够多的企业，你就会被要求两者都支持。不是迟早，而是反反复复。 那些坑——也正是自己动手会变得昂贵的地方 SAML 的问题在于它是一种签名 XML 协议，而签名 XML 是应用密码学中最稳定可靠地危险的东西之一。把 SAML 签名校验做错的方式既多又出名： 签名包装（XSW）： 攻击者移动已签名的元素，把一份未签名、伪造的断言塞到你的解析器实际读取的位置。如果你把校验签名和读取断言做成两个分开的步骤，那你大概率就有漏洞——而几乎每一个初版实现做的恰恰就是这件事。 规范化与注释注入： 2018 年那一类漏洞， user@company.com<!---->.evil.com 在签名校验时按一种方式规范化、在你代码读取的字符串里按另一种方式规范化，于是你乐呵呵地把错误的人认证通过了。真实存在的 CVE，涉及多个主流库。 那些更不起眼的： 只签名响应却不签名断言、接受未签名的断言、信任 IdP 提供的颁发者却不做固定校验、把断言的有效期窗口算错。每一个都是自己的一颗地雷，而且每一个都被本该懂行的人发布到了生产环境。 OIDC 明显更理智一些，但也并非没有锋利的边角。你仍然得校验正确的声明（ iss 、 aud 、 exp 、以及 nonce ）、使用 PKCE、拒绝早已作古的 implicit 流程，还要在轮换和缓存 JWKS 时不至于拒掉一个由你尚未拉取的密钥所签名的令牌。区别在于，OIDC 的陷阱有文档可查、是 JSON 形态的，并且在大多数库里默认就被正确处理。SAML 的陷阱是 XML 形态的，已经吞掉过资源远比你充裕的安全团队。 真正的答案 "OIDC 还是 SAML"是个错误的问题，因为对一款 B2B 产品来说，正确的答案是"都要"。你的现代客户和你自己的应用想要 OIDC。你的企业客户会在一个你无法掌控的时间表上强制要求 SAML。只为其中一个去构建，第三通销售电话就会把它打破。 你真正需要的，是一种能接住每个客户带来的任意协议的办法，而不必搭起两套技术栈、两套元数据管线，以及两次各自独立、各自把签名校验做错的机会。实现才是成本所在。选择从来都不是难的那部分。 而这正是 Authagonal 替你卸下的那部分。每个租户都能获得带一键元数据导入的 SAML 2.0，以及与你客户已在使用的提供方对接的 OIDC 联合登录，二者共用同一个登录入口，且任何一种都不收取按连接计费的费用。你不必实现 XML 签名校验，不必照看 JWKS 缓存，也不必在下一个说着另一种协议的客户出现时把这一切重建一遍。 看看都包含了什么。

Originally published at daniel-yang.com . I've been using passkeys for a while now, and at some point I noticed an extension in the WebAuthn spec that almost nobody talks about: PRF. It lets a website ask your authenticator to evaluate a pseudo-random function during login. Deterministic output, 32 bytes, keyed to that specific credential, never leaves your browser. That's an encryption key. Sitting inside the same ceremony everyone already uses for login. So I built pknotes to see how far the idea goes: an end-to-end encrypted notes app with no master password anywhere. Your passkey unlocks your notes in the literal, cryptographic sense. This post is the architecture writeup. There's a live demo if you'd rather poke it first (notes wiped daily). One ceremony, two jobs A normal passkey login proves who you are and nothing else. With the PRF extension, the same ceremony does double duty: The server verifies the WebAuthn assertion. That's login. The client reads the PRF output from the same response and derives a key from it. That's decryption. The server never sees the PRF bytes. They're returned to client-side JavaScript only, after user verification (Face ID, Touch ID, PIN), and only for the requesting origin. Requesting it looks like this: const credential = await navigator . credentials . get ({ publicKey : { challenge , userVerification : ' required ' , extensions : { prf : { eval : { first : new TextEncoder (). encode ( ' pknotes/prf-eval/v1 ' ) } }, }, }, }); const prfOutput = credential . getClientExtensionResults (). prf . results . first ; // 32 bytes, deterministic for this credential + this input, never sent anywhere The key hierarchy Raw PRF output shouldn't encrypt data directly, and you also want to be able to add and remove devices without re-encrypting everything. So there's a small hierarchy: Passkey PRF output │ HKDF-SHA256 ▼ KEK (key-encryption key, exists only in browser memory) │ unwraps ▼ Master key (random AES-256, generated once at signup) │