https://www.authaction.com/blog.html Practical writing on OAuth2, OpenID Connect, passkeys, and token security. en https://www.authaction.com/blog/why-jwt-signature-verification-fails.html https://www.authaction.com/blog/why-jwt-signature-verification-fails.html Fri, 14 Aug 2026 00:00:00 GMT Your token looks fine, decodes cleanly, and still fails verification. Here are the eight things that actually cause it, in the order worth checking them. https://www.authaction.com/blog/oauth2-vs-oidc.html https://www.authaction.com/blog/oauth2-vs-oidc.html Wed, 12 Aug 2026 00:00:00 GMT OAuth2 is authorization, OIDC is authentication built on top of it. Here's what that means concretely, and why using an access token to identify a user is a real vulnerability. https://www.authaction.com/blog/what-breaks-without-pkce.html https://www.authaction.com/blog/what-breaks-without-pkce.html Sat, 08 Aug 2026 00:00:00 GMT PKCE is not just for mobile apps anymore. Here's the concrete attack it prevents, why the client secret doesn't save you, and why the spec now recommends it for every OAuth2 client. https://www.authaction.com/blog/passkeys-vs-mfa.html https://www.authaction.com/blog/passkeys-vs-mfa.html Wed, 05 Aug 2026 00:00:00 GMT TOTP and SMS codes make phishing harder. Passkeys make it structurally impossible. The difference is origin binding, and it's worth understanding before choosing. https://www.authaction.com/blog/redirect-uri-mismatch.html https://www.authaction.com/blog/redirect-uri-mismatch.html Sat, 01 Aug 2026 00:00:00 GMT The error says the URI doesn't match a registered value. Matching is exact string comparison, which makes the causes narrow and mostly invisible — trailing slashes, ports, casing, and encoding. https://www.authaction.com/blog/refresh-token-rotation.html https://www.authaction.com/blog/refresh-token-rotation.html Wed, 29 Jul 2026 00:00:00 GMT Rotation plus reuse detection is the right design. It also logs users out at random if your client can fire two refreshes at once — here's why, and the two ways to fix it. https://www.authaction.com/blog/where-to-store-tokens-in-a-browser.html https://www.authaction.com/blog/where-to-store-tokens-in-a-browser.html Sat, 25 Jul 2026 00:00:00 GMT localStorage, cookies, memory, or a backend-for-frontend. Every option trades XSS exposure against CSRF exposure and complexity — here's the actual tradeoff rather than the usual dogma. https://www.authaction.com/blog/rotating-jwks-keys-without-downtime.html https://www.authaction.com/blog/rotating-jwks-keys-without-downtime.html Tue, 21 Jul 2026 00:00:00 GMT Key rotation fails when the new key starts signing before consumers have seen it. The fix is an overlap window sized by your cache TTL and token lifetime — here's the sequence. https://www.authaction.com/blog/scopes-vs-roles-vs-relationships.html https://www.authaction.com/blog/scopes-vs-roles-vs-relationships.html Fri, 17 Jul 2026 00:00:00 GMT OAuth2 scopes answer what an application may do. Roles answer what a user may do. Neither answers whether this user may edit that specific document — and cramming it into a token is how you get 8KB headers.