Blog
Blog
On OAuth, OpenID Connect, and application security
One Proxy, Every Authorization Decision: Inside Versola's Edge
How Versola's edge proxy turns permissions, CEL-based dynamic rules, RFC 9470 step-up and identity injection into one ordered pipeline in front of every service, with a single observability layer covering all of it.
Read article →Why You Can't Revoke a JWT, and the One Setup Where You Can
How to revoke a JWT before it expires, why a jti blacklist in Redis is the answer everyone reaches for, and how Versola edge does it with Postgres LISTEN/NOTIFY instead: real HTTP examples.
Read article →The Long Goodbye: Password Hashing in the Age of Passkeys
Passwords are being phased out, and you still have to store them correctly. A practical tour of hashing, the attack vectors that actually get used, and the one failure mode nobody warns you about: your own defense becoming a denial-of-service vector.
Read article →Front-Channel and Back-Channel Logout: Why Your Logout Is Broken
Logging out of one app does not log a user out of every app in an SSO session. How front-channel and back-channel OIDC logout actually work, real HTTP examples, and where each one silently fails.
Read article →OAuth 2.1: What Actually Changed, and What "Supporting" It Really Means
OAuth 2.1 is still a draft, not an RFC, and it does not add anything new. It deletes the parts of OAuth 2.0 that kept causing the same five vulnerabilities. What each removal closes, and what "OAuth 2.1 compliant" should mean in practice.
Read article →