This article explains OAuth 2.0 by contrasting it with SSO, walks through a real‑world analogy, details the nine‑step authorization flow, defines key terms and roles, and describes how web servers, user agents, and native apps participate in the protocol.
This article explains why a WeChat Mini Program needs an access_token, describes the token's 7200‑second validity, and provides a step‑by‑step Java implementation that builds the request URL, sends an HTTPS GET, parses the JSON response, and outlines a simple caching strategy.
This article explains how OpenResty, built on Nginx and Lua, can be used in production to implement interface authentication, traffic control, and request logging, detailing practical implementation steps, configuration examples, and code snippets that help improve service reliability and operational efficiency.
This guide explains how to use PyInstaller or auto-py-to-exe to bundle Python scripts into Windows executables, demonstrates the steps to create and run a basic Flask application, and outlines comprehensive methods for testing API authentication mechanisms such as API keys, Basic Auth, OAuth 2.0, and JWT tokens.
The article shows how OpenResty’s Lua‑based extensions can implement lightweight, version‑controlled API authentication, dynamic traffic‑shaping via shared‑memory peer status, and selective request tracing with batch‑sent logs to Elasticsearch, enabling secure, highly available services and rich observability without sacrificing Nginx performance in production.
Recent rumors claimed that foreign hacker groups were exploiting SonarQube and Vue.js to attack government and enterprise systems, but investigation shows the SonarQube flaw is a pure backend API authentication issue unrelated to Vue, and Vue itself has no known security vulnerabilities when standard front‑end safety practices are followed.
This article explains the roles of app_id, app_key, and app_secret in third‑party platform authentication, how they differ, when they are used together, and various usage patterns for fine‑grained permission control and secure token generation.
The article explores practical approaches for authenticating internal service APIs, comparing plain token usage, IP whitelisting, and salted signature schemes with timestamps, and explains their implementation details, security trade‑offs, and suitability for a B2B cloud‑operated platform.
This article walks through practical methods for securing internal API calls—starting with simple token checks, then enhancing security with IP whitelisting, salted signatures, and timestamped requests—while weighing trade‑offs like HTTPS overhead and time synchronization.
This guide explains how to use Laravel Passport to implement OAuth2 authentication for API endpoints, covering installation, database migrations, token generation, client management, scope definition, route protection, JavaScript integration, event handling, and testing with detailed code examples.
This article explains why JWT has become the preferred method for session management in modern RESTful and SPA architectures, detailing the roles, lifecycles, and implementation steps of access_token and refresh_token, and providing concrete API examples for login and token renewal.
