ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
ASP.NET Core 3.1’s JWT bearer middleware imposes a hard‑coded five‑minute clock skew that cannot be overridden via configuration or code. This default leeway allows tokens that have technically expired to remain valid for up to five minutes, potentially exposing applications to stale credential usage. The primary objective is to enforce strict token expirati
Determine whether Mercurial automatically invalidates cached HTTPS credentials when the server‑side password is changed, or if manual cache clearing or process restart is required for the change to take effect. Mercurial stores HTTPS credentials in the operating system keyring or .hgrc and does not query the store for expiration until the cache entry is expl
Context Configuring least-privilege registry authentication for pnpm in CI/CD pipelines requires choosing between two documented approaches: (a) static read-only tokens scoped to specific registries in .npmrc , rotated manually, or (b) a credential helper that fetches short-lived tokens per request. Both satisfy granular access control, but they diverge when
Goal: Verify whether a QTest 9.2 server returns a WWW‑Authenticate challenge that indicates the expected Authorization scheme when a client sends a legacy Bearer token, allowing integrations to detect the required header format automatically. Constraints: The upgrade from 9.1 to 9.2 changed the header from Bearer to QTestToken with no deprecation warning or
DataGrip manages database connectivity through JDBC drivers, utilizing internal password-safe mechanisms or system keychains to store authentication data. While the IDE maintains persistent connections to improve performance, the lifecycle of these sessions is governed by the target database server's timeout and credential expiration policies. A challenge ar
Determine whether the npm CLI should automatically treat a token as invalid once its embedded expiry timestamp has passed, removing the need for manual revocation when adhering to least‑privilege authentication. Current behaviour leaves expiry optional; legacy tokens lack an expiry field, registries may accept stale tokens indefinitely, and the CLI provides
Locking down a self-hosted instance after guest use The goal is to restrict a self-hosted Hoppscotch Docker deployment so that collections and environments are not reachable by anyone who can open the instance URL, while preserving data a team member created while the instance ran in guest mode. Self-hosted Hoppscotch moves request data server-side once acco
Goal: Confirm that an expired session cookie is rejected both by the Middleware optimistic check and by the Data Access Layer authorization so that a protected Server Action cannot be invoked with stale credentials, enforcing least‑privilege access. Constraint: Middleware runs in the Edge runtime where Node‑only APIs are unavailable and response mutation for
Goal I want to choose a single credential‑expiry mechanism for application roles that follows least‑privilege principles, so that expiry behaves predictably and cannot be sidestepped by other authentication methods. Constraints and uncertainty PostgreSQL’s VALID UNTIL timestamp only blocks password‑based logins; it is ignored for cert , peer , trust and simi
mercurial
pnpm
qtest
datagrip
docker
hoppscotch
nextjs
dotnet