OIDC vs SAML: How to Choose the Right SSO Protocol for B2B Software

·1 views

When enterprise clients demand single sign-on (SSO), B2B software teams typically face a choice between two protocols: SAML, an XML-based standard from 2005, and OIDC, a JSON/JWT-based protocol built on OAuth 2.0 and introduced in 2014. In practice, the choice is rarely made by the developer — it is dictated by the client's existing identity infrastructure, such as legacy ADFS systems favouring SAML or modern platforms like Okta and Entra ID supporting both. OIDC is generally preferred for modern web apps, SPAs, mobile applications, and internal tools, while SAML remains deeply entrenched in large enterprises due to legacy systems and procurement decisions made years ago. SAML carries significant security risks, including signature wrapping attacks, comment-injection flaws, and unsigned assertion acceptance — vulnerabilities that have affected multiple major libraries. Teams selling broadly to enterprises should expect to implement both protocols, not as a future consideration, but as a recurring operational reality.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Custom Claude Code Status Line Showing Quota, Cost, and Context Usage

A developer has created a fully customized status line for Claude Code that displays plan quota, session cost, context usage, and automation health in a three-line readout. The setup uses Claude Code's built-in statusLine.command feature in settings.json, which pipes JSON data directly into an arbitrary shell script on every turn. Because quota and cost data flow in via stdin, the solution requires no extra API calls or authentication. The motivation was practical: running overnight automation jobs caused quota limits to silently zero out, causing tasks to be skipped without any visible warning. The script caches the latest JSON to a temp file as a fallback, ensuring the status line remains informative even when stdin is empty.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hallmark Hits 12K GitHub Stars With AI Code Quality Tool for Frontend Agents

A tool called Hallmark, built by Hassan El Mghari at Together AI, reached 12,200 GitHub stars this week and topped Trendshift's trending repositories on July 15, 2026, gaining nearly 1,500 stars in a single day. The project is an anti-AI-slop design skill compatible with coding agents like Claude Code, Cursor, and Codex, installable via a single command. Rather than a component library, Hallmark is an instruction file that constrains how AI agents generate frontend output by running 57 deterministic quality checks before delivering any page. These checks span six categories and catch common AI-generated design patterns such as uniform border-radius values, identical card heights, and overused color gradients. The tool's rapid growth is seen as a signal that developer focus is shifting from AI capability to quality control over AI-generated output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Story Blockchain Treats IP as On-Chain Protocol, Opens Standard EVM Access

Story is an EVM-compatible Layer 1 blockchain (chain ID 1514) that launched its mainnet, codenamed Homer, in February 2025 after raising an $80 million Series B led by a16z. The chain is built on the Cosmos SDK with CometBFT consensus and an EVM execution layer, offering roughly 2–3 second block times with single-block finality and no risk of chain reorganizations. Its core innovation is the Proof-of-Creativity protocol, a suite of smart contracts that register intellectual property as on-chain assets, attach programmable license terms, and automate royalty flows through derivative trees. Developers interact with Story using standard Ethereum tooling such as viem or ethers.js, querying IP ownership, license conditions, and royalty data via ordinary eth_call and eth_getLogs methods. The chain positions itself as infrastructure for licensing creative works and AI training data on-chain, with IP as its native gas and governance token.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Build AI Agent MVPs Around Human Verification, Not Maximum Autonomy

Most AI agent prototypes prioritize autonomy over reliability, but developers are advised to instead focus on the smallest workflow a human can verify. The recommended approach divides tasks into three categories: deterministic code steps, model-based judgment, and actions requiring human approval before execution. Defining strict typed contracts for each tool — including inputs, outputs, permissions, and failure responses — makes agents testable and prevents unintended permission creep. Early releases should favor read-only tools, with humans approving any high-impact external actions such as sending messages or modifying production data. The goal of an MVP is not to simulate a fully autonomous system, but to demonstrate that a narrow workflow can produce repeatable, verifiable value.

0 comments Read more at DEV Community