Tag

IETF

8 posts

October 2026

The Primary Key That Knew What Time It Was: UUIDv7, RFC 9562, and Choosing Identifiers That Age Well RFC 9562 replaced the 2005 UUID specification in May 2024 and added UUIDv7: a 48-bit Unix millisecond timestamp followed by random bits, so identifiers sort by creation … Research 28 min read The Login Link Landed in Spam: SPF, DKIM, DMARC, and the Year DMARC Became a Standard If your product signs people in with a one-time code or a magic link, email is part of your authentication system, and three DNS records decide whether that email … Research 30 min read

September 2026

The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read Secret Zero: How SPIFFE and the IETF's WIMSE Drafts Kill the Credential That Never Expires Every distributed system accumulates credentials that outlive the services they were minted for: an API key in a CI variable, a cloud access key in an environment file, a … Research 24 min read

August 2026

Retry Without Paying Twice: Idempotency Keys and the Draft That Expired in April Every payment API ships a header called Idempotency-Key, and no RFC defines it. The IETF draft that tried expired on 18 April 2026, is absent from the IANA field-name … Engineering 30 min read HTTP Message Signatures: How RFC 9421 Turned a Decade of Ad Hoc Signing Into One Spec Before February 2024, every API vendor invented its own way to sign an HTTP request: AWS built SigV4, Stripe and GitHub built timestamp-plus-HMAC webhook headers, and the … Research 23 min read

July 2026

Rate Limits Are a Contract: Algorithms, Keys, State, and the Fail-Open Question Nobody Wants to Own A rate limit is not a throttle knob — it is a published promise with two failure modes, and most teams have never decided which one they signed up for. This post works … Engineering 21 min read

June 2026

OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read

All posts