Lock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
summary
Checklist of concrete, actionable choices: avoid HTTP Basic, form-based widgets, SAML for new apps; favor OAuth 2.1 + PKCE, OpenID Connect, short‑lived tokens, MFA or passwordless (magic links/USB keys). Treat JWTs as data format not session replacement; prefer server sessions or opaque tokens for revocation. Use API gateways and published SDKs; rotate and vault secrets with HashiCorp Vault / cloud secret managers; run Snyk/Docker scan/Clair/Dependabot on images; encrypt Kubernetes secrets (sealed‑secrets) and automate certs with Let’s Encrypt. These patterns reduce blast radius and speed fixes.
AI-written summary · about
chapters (37)
- 0:00Intro
- 5:02Agenda
- 5:59What is auth
- 10:53Developer Personas
- 13:58Basic Auth
- 15:39FormBased Auth
- 17:05SAML
- 18:39JWT
- 20:35Resources
- 21:41OpenID Connect
- 23:11MFA
- 25:44Passwords
- 27:34App Auth Ranking
- 29:31API Auth Security
- 30:13HTTP Basic
- 31:05Tokens
- 32:22Understanding Auth
- 35:21Authorization Code Flow
- 36:26Client Credentials
- 37:17API Gateway
- 38:24Client Credential
- 38:52API SDKs
- 39:47Secrets
- 40:57RoleBased Access Control
- 42:04API Auth Rating
- 43:57Dont Build Things Yourself
- 45:11Infra
- 46:15Linux
- 48:16SSH
- 48:49TLS
- 51:01Make Cert
- 51:24SSH for Servers
- 52:18Scanning for Vulnerability
- 53:42Cloud Native Security
- 54:46Kubernetes Tips
- 55:43Kubernetes Secrets
- 59:26Ratings
