Back-End Development
4,701 items in 32 lists
-
Temporary Email Address Domains gist.github.com
A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).
-
Discussion Forum discourse.slimframework.com
The official Slim Framework discussion forum.
-
Four cents to deanonymize: Companies reverse hashed email addresses freedom-to-tinker.com
“Hashed email addresses can be easily reversed and linked to an individual”.
-
IAM Is The Real Cloud Lock-In forrestbrazeal.com
A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”
-
API Tokens: A Tedious Survey fly.io
An overview and comparison of all token-based authentication schemes for end-user APIs.
-
Automated security testing for Software Developers fahrplan.events.ccc.de
Most privacy breaches were allowed by known vulnerabilities in third-party dependencies. Here is how to detect them by the way of CI/CD.
-
The EnterpriseReady SaaS Feature Guides enterpriseready.io
The majority of the features making B2B users happy will be implemented by the IAM perimeter.
-
Bloom Filter en.wikipedia.org
Perfect for this use-case, as bloom filters are designed to quickly check if an element is not in a (large) set. Variations of bloom filters exist for specific data types.
-
The Beer Drinker's Guide to SAML duo.com
SAML is arcane at times. A another analogy might helps get more sense out of it.
-
DigitalOcean Accounts changelog docs.digitalocean.com
All the latest accounts updates on DO.
-
An Illustrated Guide to OAuth and OpenID Connect developer.okta.com
Explain how these standards work using simplified illustrations.
-
Why differential privacy is awesome desfontain.es
Explain the intuition behind differential privacy, a theoretical framework which allow sharing of aggregated data without compromising confidentiality. See follow-up articles with more details and practical aspects.
-
Descope descope.com
Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.
-
Semantic-based Automated Reasoning for AWS Access Policies using SMT d1.awsstatic.com
Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.
-
Trust and safety 101 csoonline.com
A great introduction on the domain and its responsibilities.
-
Stop using JWT for sessions cryto.net
And why your "solution" doesn't work, because stateless JWT tokens cannot be invalidated or updated. They will introduce either size issues or security issues depending on where you store them. Stateful JWT tokens are functionally the same as session cookies, but without the…
-
cryptoanarchy.wiki cryptoanarchy.wiki
Cypherpunks overlaps with security. This wiki compiles information about the movement, its history and the people/events of note.
-
GCP IAM release notes cloud.google.com
Also of note: Identity Platform, Resource Manager, Key Management Service/HSM, Access Context Manager, Identity-Aware Proxy, Data Loss Prevention and Security Scanner.
-
Biscuit clever-cloud.com
Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like…
-
Password Storage Cheat Sheet cheatsheetseries.owasp.org
The only way to slow down offline attacks is by carefully choosing hash algorithms that are as resource intensive as possible.
-
The Case for Granular Permissions cerbos.dev
Discuss the limitations of RBAC and how ABAC (Attribute-Based Access Control) addresses them.
-
SMS Multifactor Authentication in Antarctica brr.fyi
Doesn't work because there are no cellphone towers at stations in Antarctica.
-
Don't get clever with login forms bradfrost.com
Create login forms that are simple, linkable, predictable, and play nicely with password managers.
-
SAML: A Fractal of Bad Design blog.trailofbits.com
“SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…
-
Getting 2FA Right in 2019 blog.trailofbits.com
On the UX aspects of 2FA.
-
AWS Security, Identity & Compliance announcements aws.amazon.com
The source of all new features added to the IAM perimeter.
-
Security Recommendations for Any Device that Depends on Randomly-Generated Numbers av8n.com
“The phrase 'random number generator' should be parsed as follows: It is a random generator of numbers. It is not a generator of random numbers.”
-
Using JSON Web Tokens as API Keys auth0.com
Compared to API keys, JWTs offers granular security, homogeneous auth architecture, decentralized issuance, OAuth2 compliance, debuggability, expiration control, device management.
-
Adding JSON Web Token API Keys to a DenyList auth0.com
On token invalidation.
-
Dark Patterns after the GDPR arxiv.org
This paper demonstrates that, because of the lack of GDPR law enforcements, dark patterns and implied consent are ubiquitous.
-
Browser Fingerprinting: A survey arxiv.org
Fingerprints can be used as a source of signals to identify bots and fraudsters.
-
How Uber Got Lost archive.ph
“To limit "friction" Uber allowed riders to sign up without requiring them to provide identity beyond an email — easily faked — or a phone number. (…) Vehicles were stolen and burned; drivers were assaulted, robbed and occasionally murdered. The company stuck with the…
-
-
Anti-captcha anti-captcha.com
💸 Captchas solving service.
-
Practical Recommendations for Stronger, More Usable Passwords andrew.cmu.edu
This study recommend the association of: blocklist checks against commonly leaked passwords, password policies without character-class requirements, minimum-strength policies.
-
AMF site blocklist amf-france.org
Official French denylist of money-related fraud sites.
-
SMS: The most popular and least secure 2FA method allthingsauth.com
-
The never-ending product requirements of user authorization alexolivier.me
How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.
-
Awesome Identifiers adileo.github.io
A benchmark of all identifier formats.
-
OAuth 2 Simplified aaronparecki.com
A reference article describing the protocol in simplified format to help developers and service providers implement it.
-
Tutorial: Setting up Tortoise ORM with FastAPI web.archive.org
-
Modern APIs with FastAPI and Python training.talkpython.fm
A course designed to get you creating new APIs running in the cloud with FastAPI quickly.
-
Full Web Apps with FastAPI Course training.talkpython.fm
You'll learn to build full web apps with FastAPI, equivalent to what you can do with Flask or Django.
-
FastAPI Example tortoise.github.io
An example of the Tortoise-ORM FastAPI integration.
-
Tortoise ORM tortoise.github.io
An easy-to-use asyncio ORM (Object Relational Mapper) inspired by Django.
-
Test-Driven Development with FastAPI and Docker testdriven.io
Learn how to build, test, and deploy a text summarization microservice with Python, FastAPI, and Docker.
-
The Definitive Guide to Celery and FastAPI testdriven.io
Learn how to add Celery to a FastAPI application to provide asynchronous task processing.
-
TestDriven.io FastAPI testdriven.io
Multiple FastAPI-specific articles that focus on developing and testing production-ready RESTful APIs, serving up machine learning models, and more.
-
Using Hypothesis and Schemathesis to Test FastAPI testdriven.io
Apply property-based testing to FastAPI.
-
Real-time data streaming using FastAPI and WebSockets stribny.name
Learn how to stream data from FastAPI directly into a real-time chart.
- next page of items loading…
