New JavaScript library paseto-kit brings full PASETO v3/v4 and PASERK support

·3 views

A developer has released paseto-kit, a JavaScript library designed to fill the gap in maintained implementations of PASETO, a security-focused alternative to JWT. The library supports both PASETO v3 (NIST/FIPS-friendly using P-384, AES-256-CTR, and HMAC-SHA384) and v4 (XChaCha20, BLAKE2b, and Ed25519). It includes complete PASERK support across all 11 key types, registered-claims validation, and password-based key wrapping. Built on audited @noble/* cryptographic primitives, the library is runtime-agnostic and runs on Node, Deno, Bun, browsers, and edge environments without relying on Node-specific APIs. The author acknowledges the project is pre-1.0 and has not yet undergone an independent third-party security audit.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Uses Rival AI Model to Audit Own Writing, Finds 6 Real Errors in 10 Posts

A software developer ran a cross-vendor AI audit experiment after realizing the same model family was both writing and reviewing his engineering blog posts. He fed ten queued articles to a different vendor's AI model, instructing it to flag technical errors, inconsistencies, and unsupported claims while verifying each finding against the web. The auditor returned seven findings, of which six were confirmed genuine errors after independent re-verification; one was a false positive where the auditor misread a correct sentence. The three most serious errors were macOS-incompatible Linux commands embedded in copy-pasteable code blocks, including one that silently destroys the file it is meant to inspect. The experiment highlighted that cross-vendor AI review is a finding generator, not a final verdict, and that independent verification remains essential to avoid trading one model's blind spots for another's.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Classic Design Patterns That Actually Belong in an E-Commerce Cart

A software developer revisited the Gang of Four Design Patterns book by building a complete e-commerce checkout flow, introducing each pattern only when a genuine requirement demanded it. Strategy handles variable shipping fees, Decorator stacks promotional rules like free shipping thresholds, and State manages the distinct behaviours of cancel or refund across order lifecycle stages. Observer decouples the payment method from downstream reactions such as emails, stock updates, and accounting, while a Facade exposes a single placeOrder() method to the controller. Two patterns were deliberately excluded, reinforcing the book's own warning against 'pattern fever': a pattern should only be applied where the flexibility it provides is genuinely needed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Make Your Website a Source AI Assistants Actually Cite

AI assistants like ChatGPT, Perplexity, and Gemini cite sources they can reliably access, read, and verify. Websites must serve pre-rendered or static content, since AI crawlers cannot execute JavaScript and will skip client-rendered pages. Structured data in JSON-LD format helps assistants accurately attribute facts to the correct source, especially when paired with consistent external references like Wikidata entries. Independent third-party mentions and directory listings strengthen a site's credibility, as assistants favor claims they can confirm across multiple sources. Site owners can monitor their citation status by regularly querying AI assistants with relevant questions and tracking which sources are named in the responses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Shuts Down 8-Agent AI Video System After 298 Tickets Produced Just 62 Videos

A developer built an eight-agent AI system designed to autonomously produce 60-second YouTube videos, but the project required 298 support tickets to generate only 62 finished videos, averaging 4.3 tickets per video. Every failure traced back to the same root cause: agents operated in isolated LLM sessions with no shared context, meaning nothing was automatically pushed to an agent when relevant state changed. This led to cascading issues including duplicate content being queued, QA agents approving work that did not yet exist, stalled handoffs caused by a single mistyped agent handle, and agents overwriting each other's uncommitted work in a shared codebase. The developer has since retracted earlier write-ups that framed the project as progress, clarifying that the failures were architectural rather than model-related. The system and its data have been open-sourced as a documented case study in the limits of multi-agent orchestration.

0 comments Read more at DEV Community