ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Goal: Confirm that a FeathersJS service protected by a before hook that validates the presence of params.user will reject requests lacking a valid authentication token, preventing unintended public exposure of data. Uncertainty: It is unclear whether the authentication middleware reliably sets params.user before the hook executes, and whether placing the val
Goal: Determine whether an expired Elasticsearch API key remains usable when allow_expired is enabled, and whether cluster-wide security settings or role assignments change that outcome. Elasticsearch can issue API keys with an explicit expiration timestamp and provides an allow_expired option for legacy integrations. The exact enforcement moment and its int
I am designing an Android app that uses AccountManager to obtain an OAuth-style auth token with a narrow scope for a specific account. The goal is to rely on the system for least-privilege credential handling without building custom token storage. On Android 8.0 (API 26) and later, AccountManager binds returned tokens to the requesting package UID and suppor
Issue When a FaunaDB login‑based token is presented after its TTL expires, the server responds with Unauthorized: invalid token . This behavior is documented for login tokens and is the primary indicator of credential expiration. Least‑Privilege Context FaunaDB supports scoped keys with specific roles (Server, Admin, Client, Custom) and ABAC predicates to re
Determine whether LeetCode's GraphQL endpoint applies the same rate‑limit and validation rules to mutation operations when the request is authenticated with a token generated for a test account versus a token from a regular production account. Because the platform does not publish an official API, the undocumented GraphQL endpoint is used via the CLI or cust
I'm using postgresql and as part of learning, I tried to change to login methods to have a more secure login methods. e.g. using scram-sha-256 instead of md5 . I tried to change my password_encryption to scram-sha256 in postgresql.conf file, and changed pg_hba.conf METHOD to scram-sha-256 as well, you can see the changes in the configuration below: # - Authe
Context Memcached has bound to 0.0.0.0:11211 since its early releases, accepting connections on all interfaces unless explicitly restricted with the -l flag. The core protocol provides no mandatory authentication; optional SASL support requires compile-time enablement and client cooperation, and is rarely deployed in practice. Package maintainers for Debian,
Goal We need to enforce least‑privilege authentication while ensuring credentials expire automatically. Current Constraints NGINX’s auth_basic validates against static credentials and auth_request delegates to an external service, but neither interprets token expiry or revocation. Uncertainty There is no documented NGINX directive that enforces expiration. T
When a Personal Access Token (PAT) used by Visual Studio to authenticate with Azure DevOps expires, the IDE shows a credentials‑not‑valid prompt and requires manual renewal. The goal is to understand whether Visual Studio can be configured to automatically handle PAT expiration through the Azure DevOps SDK or Windows Credential Manager without user intervent
Asked · 28 Dec 2023, 08:22 UTC
answered · 31 Dec 2023, 08:22 UTC
elasticsearch
android
leetcode
postgresql
nginx
visualstudio