Envelope Encryption
How the CMK/DEK two-tier key structure in envelope encryption limits key leak impact and simplifies key rotation.
Security
Session Authentication and JWT
HTTP is stateless. Maintaining user authentication requires storing state somewhere. This post covers the structure, trade-offs, and storage strategies of server-side sessions and client-side JWT tokens.
A Map of Authentication Methods: From Basic to SSO
There was a time I called JWT an authentication method and said I logged in with OAuth, and the terms kept blurring together. This post lines up Basic, Digest, API Key, Session, Token, OAuth, OIDC, and SSO by two questions: authentication vs authorization, and where the proof of identity lives.