ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Passport's local strategy leaves two decisions to you: what the verify callback returns and what goes into the session. Get both right—id-only serialization, single-purpose verify—and the rest is just routes.
If your iOS app offers any social login, App Review requires Sign in with Apple too. Here's how to choose between Apple, email, and social login — and how to verify the identity token correctly on your backend.
AngularJS $http interceptors let you attach auth tokens and handle 401s in one place — if you scope them with an URL allowlist and propagate rejections correctly. Here's a worked example with tests.
Ory Kratos uses one JSON Schema document as the source of truth for identity traits, driving both server-side validation and self-service form rendering. Here's how it works, with a worked example and the migration trap to avoid.
Learn how to design a minimal, secure custom user model in Django using AbstractBaseUser, from requirements through operational checks and failure‑mode mitigation. The guide covers email‑based auth, manager implementation, and when to rethink the design.
A diagnostic guide to Sign In with LinkedIn via OpenID Connect: map each error (unauthorized_scope_error, invalid_redirect_uri, token 401) to its cause and fix.
Eliminate password friction by implementing Supabase Magic Links. Learn how to set up passwordless OTP authentication, handle redirects, and secure your flow against phishing.
Learn how Passport.js uses the strategy pattern and session serialization to decouple authentication methods from session storage, reducing route bloat and improving maintainability.
When building a SPA with Okta, the Authorization Code Flow with PKCE is the secure, recommended choice. This guide compares Implicit, Auth Code PKCE, and Hybrid flows, explains trade‑offs, and walks through a concrete implementation using @okta/okta-auth-js.
express
nodejs
linkedin
supabase
passport
okta