Tag

OAuth

3 posts

September 2026

The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read

August 2026

MCP Authorization: How the AI Agent Protocol Learned OAuth the Hard Way In its first four months, the Model Context Protocol asked every server author to build a miniature identity provider from scratch. It took a blog post, a security … Research 22 min read

June 2026

OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read

All posts