Why Cache Expiry Settings Are a Critical Part of Authorization Security

·1 views

Caching is commonly used to speed up authorization decisions, but it can also keep revoked permissions active long after the source system has updated them. A stale cached 'allow' can preserve a user's access even after their role, device compliance, or employment status has changed. Unlike stale display names, stale security attributes such as device posture or employment status carry real risk and require carefully chosen expiry windows tied to operational risk. Developers are advised to track whether each authorization attribute came from a live source or cache, along with its observation time, to enable accurate auditing. Testing should cover not just cache hit rates but also scenarios where a revocation event is delayed, forcing teams to account for the maximum window of unauthorized access exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds production e-commerce store solo using Claude Code, documents real failures

A solo developer used Anthropic's Claude Code AI tool to build a production-ready e-commerce store for a women's clothing boutique, handling most of the code generation while the developer managed architecture and code review. The project required syncing with 1C, a widely used Russian ERP system that communicates only via XML, while staying within a tight budget that ruled out conventional enterprise platforms like Bitrix. The stack was built on WordPress, WooCommerce, and a fully custom block-based theme, deliberately avoiding page-builder plugins to preserve performance and design control. The client's existing React prototype demanded a precise pixel-for-pixel recreation, including strict design tokens managed through WordPress's native theme.json file. The developer published the account on DEV Community, emphasizing real-world bugs and limitations rather than a polished showcase of AI-assisted development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why MCP Memory Servers Show 'Connected' But Don't Share Data Across Editors

Developers using both Cursor and Claude Code with a shared MCP memory server may find that notes saved in one editor are invisible to the other, despite both clients reporting a healthy connection. The root cause is that a successful connection only confirms the transport layer is working, not that both clients are authenticated to the same account or backend store. An analysis of six persistent memory systems found that the most common failure mode is two clients connecting to different accounts or data stores without triggering any error. Some systems, like Cognee, also offer distinct architecture modes — standalone versus API-connected — where only the latter enables cross-client sharing. The consistent fix across all reviewed tools is ensuring every client uses the same account credentials and points to the same backend, rather than assuming a connected status implies shared memory.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sky Lending Governance Rated High Risk With Two Critical Vulnerabilities Found

A DeFi security audit of Sky Lending, a permissionless lending platform with approximately $5.45 billion in total value locked across Ethereum and Layer 2 networks, has assigned the protocol an overall governance risk score of 7.5 out of 10. Auditors identified eight vulnerabilities, with the most severe being a potential timelock bypass via re-entrancy in the execute function and unrestricted upgradeability through a ProxyAdmin solely controlled by the Governor contract. The report warns that an attacker acquiring as little as 0.6 percent of the SKY token supply — worth roughly $30 million — could push through malicious proposals due to a low 0.5 percent quorum threshold. Additionally, the top ten token holders control around 38 percent of voting power, with a single treasury address holding 12 percent and also owning the ProxyAdmin, creating a dangerous concentration of control. The audit concludes that both critical flaws could allow an adversary to seize full protocol control in a single transaction, threatening all user funds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Benchmarks Show Stdio Is 9x Faster Than SSE for MCP Tool Calls

A benchmark of 10,000 tool executions compared the two main Model Context Protocol transports — Stdio and Server-Sent Events (SSE) — to assess their impact on AI agent performance. Stdio delivered a mean latency of 2.1ms versus 19.4ms for remote SSE, with SSE also adding up to 45ms for connection setup due to TCP handshakes and TLS. The gap becomes significant in autonomous agents like Cursor or Claude Desktop, where 10–15 sequential tool calls are common and overhead compounds quickly. Stdio is recommended for local developer and desktop environments, while SSE remains better suited for multi-tenant cloud setups requiring authentication and rate-limiting controls. Memory usage also varied, with compiled Go or Rust workers consuming under 7MB per process compared to around 42MB for a centralized SSE daemon.

0 comments Read more at DEV Community