Developer details three PASETO token mistakes in deal-scoped MCP authorization systems

·4 views

A developer building a pseudonymous two-agent brokering system documented implementation lessons while aligning with the Model Context Protocol's authorization spec, currently at its 2026-07-28 revision. The MCP spec requires servers to reject any access token not explicitly issued for them as the intended audience, a rule that has been normative since the 2025-06-18 revision. The developer used PASETO tokens scoped to individual transactions rather than servers, mirroring the MCP requirement that a token valid for one resource must be worthless at any other. Key mistakes included using a fixed key identifier string that broke key rotation for seven-day credentials, since old and new keys shared the same name with no overlap window. The proposed fix involves deriving key identifiers via fingerprinting rather than static naming, allowing multiple keys to coexist during rotation periods.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

From One VM to Per-Service LXC Containers: A Self-Hoster's Infrastructure Journey

A self-hosting enthusiast documented their evolution from running all services inside a single Docker-enabled VM to adopting Proxmox LXC containers on a per-service basis. The initial single-VM setup was fast to deploy but fragile, as any bad update or resource spike affected every service simultaneously. Splitting workloads into purpose-built VMs improved resilience and enabled Proxmox high-availability failover, but GPU sharing limitations exposed the approach's ceiling. The shift to one LXC container per service offered finer isolation, cross-node failover, and greater efficiency. The author frames each architectural stage as a deliberate tradeoff rather than a mistake, arguing that real infrastructure knowledge is gained by navigating the balance between consolidation and separation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an SSH Key Can Rescue Your GitLab Account After a 2FA Lockout

A developer lost access to their GitLab account after a failed authenticator app migration wiped their 2FA setup and left them without recovery codes. GitLab provides only two account recovery options: email verification or generating new recovery codes via a linked SSH key. Because the developer had previously added an SSH key to their GitLab account for authentication and commit signing, they were able to run a single SSH command to retrieve fresh recovery codes. Using one of those codes, they successfully logged back in and re-enabled 2FA. The incident highlights the importance of storing recovery codes securely and maintaining an SSH key linked to your GitLab account as a backup access method.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Knowledge Graphs Can Make Drupal Content Smarter and More Connected

Knowledge graphs offer a way to connect Drupal content entities — such as nodes, taxonomy terms, users, and media — into an intelligent, relationship-driven network rather than storing them as isolated records. By integrating with graph databases like Neo4j or Amazon Neptune, Drupal sites can map relationships between content and query them efficiently. This approach enhances content discovery by surfacing contextually related material even when exact keywords are absent, and can power recommendation engines based on meaning rather than tags. Knowledge graphs also provide structured context for AI applications, enabling more accurate responses from large language models and supporting use cases like enterprise knowledge bases and intelligent documentation systems. Practical implementation requires consistent metadata, secure API access, performance-optimized queries, and ongoing data quality checks as the graph scales.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A valid SPF record can silently fail email authentication — here's why

A common but hard-to-detect SPF failure occurs when a domain exceeds ten DNS lookups, a limit set by RFC 7208 that causes receivers to treat the entire SPF record as unusable rather than partially valid. Unlike syntax errors, this issue produces no warning in standard DNS tools or outgoing mail tests, making it invisible to most senders. The problem can be triggered by a third-party vendor quietly updating their own SPF record, pushing a domain over the limit without any change on the sender's side. The only reliable place to spot the failure is in DMARC aggregate reports, which many organizations do not actively monitor. The most straightforward fix is removing SPF includes for email services no longer in use, which immediately reclaims lookup budget at no cost.

0 comments Read more at DEV Community