Just released: #swad v0.3!

https://github.com/Zirias/swad/releases/tag/v0.3

swad is the "Simple Web Authentication Daemon", your tiny, efficient and (almost) dependency-free solution to add #cookie + login #form #authentication to whatever your #reverse #proxy offers. It's written in pure #C, portable across #POSIX platforms. It's designed with #nginx' 'auth_request' in mind, example configurations are included.

This release brings a file-based credential checker in addition to the already existing one using #PAM. Also lots of improvements, see details in the release notes.

I finally added complete build instructions to the README.md:

https://github.com/Zirias/swad

And there's more documentation available: manpages as well as a fully commented example configuration file.

Secure a Vue App With OpenID Connect and the BFF Pattern, by @duendesoftware.com:

https://blog.duendesoftware.com/posts/20250409-secure-vue-app-with-openid-connect-bff-pattern/

#vuejs #security #authentication

How to Setup SSH Login with Public Key #Authentication (4 Step Quick-Start Guide)

This article describes how to setup SSH login with public key authentication across your servers and clients for secure access.

If you're using SSH to connect to remote servers, public key authentication is a security best practice. Unlike password-based logins, key-based authentication is not vulnerable to brute-force attacks.

Using a key to ...
Continued 👉 https://blog.radwebhosting.com/how-to-setup-ssh-login-with-public-key-authentication/?utm_source=mastodon&utm_medium=social&utm_campaign=ReviveOldPost #publickey #sshcommands

Атаки через новый OAuth flow, authorization code injection, и помогут ли HttpOnly, PKCE и BFF

В статье детально рассмотрим интересный вектор атаки на приложения, использующие OAuth/OIDC, разберем, какие предусловия для этого нужны, и увидим, что они не так недостижимы, как может показаться на первый взгляд. Затронем использование паттерна Backend-for-Frontend и способы реализации PKCE для confidential clients, попутно проверив, помогают ли они защититься от рассматриваемой атаки. Взглянем и на другие существующие рекомендации и предлагаемые лучшие практики, а также подумаем над прочими мерами защиты, которые действительно могут помочь. Все это с примерами, схемами и даже видео. Материал будет интересен как для занимающихся разработкой приложений, так и для представляющих атакующую сторону.

https://habr.com/ru/articles/880544/

#аутентификация #authentication #pkce #backendforfrontend #bff #authorization_code_injection #confidential_clients #токен #session_id #httponly

Just released: #swad v0.2

SWAD is the "Simple Web Authentication Daemon", meant to add #cookie #authentication with a simple #login form and configurable credential checker modules to a reverse #proxy supporting to delegate authentication to a backend service, like e.g. #nginx' "auth_request". It's a very small piece of software written in pure #C with as little external dependencies as possible. It requires some #POSIX (or "almost POSIX", like #Linux, #FreeBSD, ...) environment, OpenSSL (or LibreSSL) for TLS and zlib for response compression.

Currently, the only credential checker module available offers #PAM authentication, more modules will come in later releases.

swad 0.2 brings a few bugfixes and improvements, especially helping with security by rate-limiting the creation of new sessions as well as failed login attempts. Read details and grab it here:

https://github.com/Zirias/swad/releases/tag/v0.2

New Open-Source Tool Spotlight 🚨🚨🚨

TinyAuth is a lightweight authentication backend that integrates seamlessly into your project with minimal setup. It supports password hashing (bcrypt, argon2) and JSON Web Tokens (JWT). Perfect for those prioritizing simplicity without sacrificing security. #Authentication #OpenSource

🔗 Project link on #GitHub 👉 https://github.com/steveiliop56/tinyauth

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

— ✨
🔐 P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 💻🏴‍☠️

Password auth in Rust, from scratch - Attacks and best practices

https://lpalmieri.com/posts/password-authentication-in-rust/

#rust #rustlang #authentication