Side Project OAuth Bug Inspired Secure Enterprise SSO Architecture at Work

·2 views

A developer discovered a cross-application session vulnerability in their personal emergency management platform, CrisisOps, where citizens could inadvertently access the admin dashboard after signing in. The flaw stemmed from a shared authentication backend that verified session validity but never confirmed which application the session belonged to. The fix involved issuing application-specific cookies and validating the user's destination and role before completing the OAuth callback. Three months later, the same debugging experience directly informed the developer's contribution to designing a secure token-exchange flow for enterprise single sign-on at their workplace. The incident highlighted a critical distinction between authentication — confirming identity — and authorization, which governs what each authenticated user is permitted to access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Tokscale CLI lets developers track AI token usage and costs across all coding tools

Developer Maneshwar, while building his own AI code review tool, realized he had no clear picture of how much he was spending on AI coding assistants like Cursor and Claude. This prompted him to discover Tokscale, an open-source CLI tool built in Rust that aggregates token usage and costs across multiple AI coding platforms including Claude Code, Cursor, Codex, Gemini, and GitHub Copilot. The tool works by reading existing local data files from these tools rather than requiring API keys or account setup, then prices usage against live rates and displays results in a terminal dashboard. Tokscale version 2 introduces a native Rust TUI, cross-platform support, and a GitHub-style contribution heatmap showing daily AI usage intensity. Users can run it instantly without permanent installation using a single command: npx tokscale@latest.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Reflects on How User Story Mapping Reframes Agile as a Mindset

A software developer shared key takeaways from the introduction of the book 'User Story Mapping' as part of a self-directed learning series on engineering thinking. The opening chapters argue that Agile is fundamentally a mindset focused on iterative learning, not just ceremonies like standups or sprints. The book redefines MVPs not as stripped-down products, but as the smallest set of features that delivers genuine user value. It also distinguishes between output, outcome, and impact, urging developers to measure success by changed user behavior rather than features shipped. A central theme is that user stories exist to foster shared understanding through conversation, not to serve as static documentation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Free Canada-Wide Contractor Licence Lookup Site Using Open Government Data

A developer has built a free contractor licence verification website and API aggregating 65,177 official records from Canadian provincial registries, including Quebec's RBQ and Ontario's HCRA, which previously required separate portal searches. The project uses Apify scrapers to collect and normalize data from each province, stored in a Cloudflare D1 SQLite database and served via an Astro 5 site running entirely on free-tier infrastructure. A critical bug silently reduced Ontario's builder records from tens of thousands to just 755 for two days, caused by an alphabet-only search sweep that missed numbered corporations and a detail-enrichment step that overran API usage limits mid-run. The fix involved expanding the search sweep to include digits 0–9 alongside letters and making the detail-enrichment step optional, fully restoring the Ontario dataset. The platform offers both a public search interface and a JSON/CSV API, aimed at homeowners and developers who need programmatic access to contractor licensing data.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Palantir CEO Alex Karp voices frustration shared by executives over AI direction

Palantir CEO Alex Karp has publicly expressed strong opinions about artificial intelligence that many corporate leaders reportedly share but hesitate to voice. His remarks have drawn attention for their candid tone amid broader industry debates over AI development and deployment. The Wall Street Journal reported on Karp's statements, framing them as representative of a wider executive sentiment. The story highlights growing tension among business leaders regarding the trajectory and governance of AI technology.

0 comments Read more at Hacker News