OAuth Authorization Server Built Without Storing User Profiles
OAuth servers typically combine authentication, profile management, and delegated authorization in one component. This case study describes a production architecture where the Authorization Server stores nothing about users beyond the identity asserted by an external IdP.
The system was shaped by three hard constraints. Hundreds of isolated APIs are created at runtime, each becoming its own audience. The client is a public SPA without a backend-for-frontend, so bearer tokens cannot be hidden from JavaScript. Resource servers must validate tokens locally because synchronous calls to a central AS would create unacceptable latency and a single point of failure.
The Authorization Server therefore knows only the IdP identity (provider and profileId) stored in short-lived Redis sessions. It issues short-lived access tokens and refresh tokens containing standard claims plus application claims for audience and tenant. The sub claim initially holds the federated identity; after the Main API registers or links the user, the same claim is replaced by an internal UUID together with profile claims.
Profile data lives exclusively in the Main API. This separation reduces blast radius: compromise of the AS yields no personal data, while compromise of the profile database leaves authentication untouched. The AS remains a pure issuer that can be rewritten or replaced without touching product logic.
Tokens never reside in localStorage or page memory. A Service Worker holds them in its isolated context, automatically attaches the Authorization header, and performs refresh centrally for all tabs. After login the SPA immediately revokes the first access token; the worker later obtains a fresh token via a custom FedCM grant that re-uses the existing session cookie.
The architecture also satisfies data-protection requirements by keeping personal data out of the central authority. Deletion requests are handled locally by each resource that stores a profile, eliminating the need to search the entire system for copies.
Related articles
Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA
A developer building offline license verification for a .NET desktop application evaluated Ed25519, RSA, and ECDSA P-256 before selecting the last option. The decision was driven by the requirement for zero external dependencies, keys short enough for manual entry from email, and support for key rotation without breaking existing licenses. Although Ed25519 offers faster verification and a smaller public key, it is absent from System.Security.Cryptography in both .NET 8 and .NET 10, with API approval only targeted for version 11. RSA-2048 produces signatures too long for practical use, resulting in a 571-character Base32 string that users would find cumbersome. ECDSA P-256 with SHA-256 delivers a fixed 64-byte signature that becomes a manageable 202-character key when encoded in Base32, while remaining fully available in the runtime. The article also covers performance measurements, the risks of ECDSA nonce generation, and the deliberate choice of the IEEE P1363 signature format to guarantee fixed-length output.
Pilcrow Publishes Free Comprehensive Guide on Web Authentication
Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.
redb 3.4.0 Adds Replay Checkpoints, Shared Runtime Layer and Declarative Secrets Handling for .NET Ecosystem
redb 3.4.0 delivers operational improvements for the .NET integration platform that includes typed storage over Postgres, MSSQL and SQLite, the redb.Route engine modeled after Apache Camel, the Tsak runtime with dashboard and clustering, and redb.Identity for OIDC and OAuth 2.1. The release focuses on post-deployment resilience with replay checkpoints that capture message state at named points inside routes, allowing safe re-execution of downstream steps without duplicating side effects. A shared runtime layer moves framework assemblies into a separate Libs/shared directory so that individual DLLs can be replaced without rebuilding or redeploying the entire Tsak or Identity packages. Secrets are now declared with a [Sensitive] attribute on endpoint options, ensuring URIs containing passwords or keys are sanitized before they reach logs, metrics or health checks. Additional controls include role-based access to management APIs, persistent audit trails and cryptographic signing of dynamically loaded modules. All Pro features remain free on the entire 3.x line with no licensing server required.
Neural Networks Without Magic: 80-Year History, Business Applications, and Why They Will Not Replace Experts Overnight
In an in-depth interview, Data Science team lead Vasily Ryazanov traces neural networks back to the 1970s work of his father and academician Zhuravlev, explaining that the technology is approximately 80 years old rather than a recent phenomenon. Ryazanov details how modern large language models such as ChatGPT and Claude function by predicting tokens within a context window after pre-training on massive datasets, and he contrasts prompt engineering with the deeper mathematical and programming skills required to build models. He describes real-world deployments including an antifraud system for the insurance company Alliance that automates detection of medical claim fraud. The discussion covers practical limits such as hallucinations, risks of uploading sensitive data to external services, and the psychological tendency of users to over-trust fluent model outputs. Ryazanov emphasizes that while tools like Claude and ChatGPT accelerate routine tasks, they remain assistants that require human verification on high-stakes decisions in health, finance, or security.