#Auth

A Cursor/AGENTS.md rule, a migration template and a pgTAP test so Cursor, Claude Code and Codex never ship a table with RLS off.

As a founder, it's tempting to have an assistant generate auth and move on. I tried it. The happy path worked right away. What it didn't include unless I asked: lockout, enumeration-safe errors, session revocation after a password change, refresh-token…

A critical Laravel flaw lets attackers sign in as an existing user on apps that use the built-in token API guard with MySQL or MariaDB. Are you affected, how to patch to 12.68.0 or 13.29.0, and a stopgap if you cannot update today.

A new person signs up, tries to sign in, and your app says "Email not confirmed". In code it comes...

Hey dev.to 👋 — I'm dixitcoder, and I just shipped DixitCoder, a full security & OSINT dashboard...

Most first SaaS projects die from tool choice, not from bad ideas. You open ten tabs, compare...

33 call sites ask who you are and 19 ask which venue you run. One request answers each question once, retries exactly two SQLSTATEs, and rethrows everything else on the first attempt.

33 call sites ask who you are and 19 ask which venue you run. One request answers each question once, retries exactly two SQLSTATEs, and rethrows everything else on the first attempt.

GitHub CLI v2.103.0 adds opt-in expiring OAuth tokens that refresh automatically, so a leaked access token stops working within hours. GitHub plans to make them the default for new sign-ins.

Setting up authentication in Next.js 14 (App Router) is a nightmare if you don't understand the...

Missing or insufficient permissions is Firestore working correctly. Here is the owner-scoped fix AI editors skip.

supabase start needs Docker. Here's what that costs, and the alternatives: a hand-wired native stack, or a single-process Supabase-compatible backend.

Self-host Supabase v0.8.3 with Docker Compose, generate the API keys, use Studio and fix 401 Unauthorized, PGRST301 and empty [] results from RLS.

Originally published at HOL An unauthenticated request with a malformed URL can skip Fastify not-found auth and land in a private sibling plugin fallback.…

ASP.NET Core wires up auth middleware but no login, register, refresh or 2FA endpoints. AuthEndpoints 4 adds them with cookies, JWT and passkeys.

The next parameter on PubTrivia's sign-in redirect is written on every gated request and consumed by nothing. The one route that does read a next defaults to a path that only resolves because a second redirect catches it.

Vercel is acquiring Better Auth, the open source TypeScript auth library. It stays free and MIT licensed as the team builds identity for the agent era.

If your server still posts to https://fcm.googleapis.com/fcm/send with a server key, it has stopped...

A practical guide to every CLI command, flag, and in-session slash command you need to get...