Tag

Web Standards

11 posts

November 2026

The Name That Matched Twice: Unicode Normalization, Grapheme Clusters, and Getting Bengali Text Right The same Bengali name can arrive as two different byte sequences, and your unique index, your search box and your audit log will each disagree about whether it is one … Engineering 26 min read

October 2026

The Login Link Landed in Spam: SPF, DKIM, DMARC, and the Year DMARC Became a Standard If your product signs people in with a one-time code or a magic link, email is part of your authentication system, and three DNS records decide whether that email … Research 30 min read

September 2026

The Certificate Nobody Renewed: 47-Day TLS, ACME Renewal Information, and the End of Revocation as a Safety Net The 200-day certificate limit has been in force since 15 March 2026. The 100-day limit arrives on 15 March 2027 and the 47-day limit two years after that, with … Engineering 26 min read The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read The Allowlist Was the Bug: Strict Content Security Policy, from Nonces to Trusted Types Most Content Security Policies in the wild do nothing against cross-site scripting. Google's 2016 study of 26,011 unique policies found 94.72% of them bypassable, mostly … Research 28 min read

August 2026

MCP Authorization: How the AI Agent Protocol Learned OAuth the Hard Way In its first four months, the Model Context Protocol asked every server author to build a miniature identity provider from scratch. It took a blog post, a security … Research 22 min read HTTP Message Signatures: How RFC 9421 Turned a Decade of Ad Hoc Signing Into One Spec Before February 2024, every API vendor invented its own way to sign an HTTP request: AWS built SigV4, Stripe and GitHub built timestamp-plus-HMAC webhook headers, and the … Research 23 min read

July 2026

The 202 That Tells You Nothing: Anti-Enumeration Engineering in Auth Systems Every difference between your system's answer for a user that exists and a user that does not is a database query an attacker runs for free. This post treats … Research 18 min read Rate Limits Are a Contract: Algorithms, Keys, State, and the Fail-Open Question Nobody Wants to Own A rate limit is not a throttle knob — it is a published promise with two failure modes, and most teams have never decided which one they signed up for. This post works … Engineering 21 min read

June 2026

Passkeys in Production: The Sharp Edges Nobody Puts in the Demo The WebAuthn demo takes an afternoon. Production takes a year, and the hard parts are nowhere near the ceremony code: an rp_id decision you cannot revise after launch, a … Research 20 min read OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read

All posts