Top all-time · #143
Auth0 by Okta
Company blog · auth0.com/blogsecuritywebprogramming
Auth0 by Okta is the company blog at auth0.com, writing about security, web and programming. Since 2014, 298 different Hacker News readers have linked it 733 times, most often “"Identity infrastructure, built for developers"”. It is still writing: the last post was on 2026-10-23, and you can follow it by feed.
Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization platform.
Most-linked posts?
- "Identity infrastructure, built for developers"17 people · 22 mentions · first linked 2014-02-26
- Critical Vulnerabilities in JSON Web Token Libraries17 people · 20 mentions · first linked 2016-08-11
- /blog/beating-json-performance-with-protobuf/10 people · 10 mentions · first linked 2018-01-25
- A Brief History of JavaScript9 people · 9 mentions · first linked 2017-01-17
- Auth0 announces a free production ready free plan and a free unlimited oss plan9 people · 9 mentions · first linked 2014-06-27
- /7 people · 7 mentions · first linked 2014-10-08
- The Story Behind ECMAScript 46 people · 6 mentions · first linked 2019-12-16
- /blog/how-we-hire-engineers/5 people · 28 mentions · first linked 2017-08-01
- More Benchmarks: Virtual DOM vs. Angular 1/2 vs. Mithril.js vs. Cito.js vs. The Rest5 people · 5 mentions · first linked 2016-01-07
- Critical Vulnerabilities in JSON Web Token Libraries5 people · 5 mentions · first linked 2015-04-01
What Hacker News says?
Javascript has many faults, but go look into the history of how/why it was created and given that context, it's likely many would do far worse than he did. https://auth0.com/blog/a-brief-history-of-javascript/
Comment linking /blog/a-brief-history-of-javascript/
on “Firefox usage is down despite Mozilla's top exec pay going up”Submitted Critical Vulnerabilities in JSON Web Token Libraries as a story · 147 points
HN discussion" There was a lot of internal pressure to pick one language as soon as possible. Python, Tcl, Scheme itself were all possible candidates. So Eich had to work fast. He had two advantages over the alternatives: freedom to pick the right set of features, and a direct line to those who made the calls. Unfortunately, he also had a big disadvantage: no time. Lots of important decisions had to be made and very little time…
Comment linking /blog/a-brief-history-of-javascript/
on “Firefox 70”Submitted Auth0 Extend: A new way to extend SaaS applications beyond Webhooks as a story · 34 points
HN discussionEncrypted tokens are opaque but they are also offline-verifiable. A simple opaque token has to be verified online (typically, against a database) whenever it's used. Auth0, for example, supports JWE for its access tokens: https://auth0.com/docs/secure/tokens/access-tokens/json-web-...
Comment linking /docs/secure/tokens/access-tokens/json-web-encryption
on “We pwned X, Vercel, Cursor, and Discord through a supply-chain attack”Submitted Building Serverless Apps with Webtask.io as a story · 24 points
HN discussionIf they implement it in OIDC they basically randomize the mail address for every application? What about the other scopes? https://auth0.com/docs/scopes/current/oidc-scopes
Comment linking /docs/scopes/current/oidc-scopes
on “Apple Sign In”Submitted When Your Boss Is Just Not That into You as a story · 19 points
HN discussionAny thoughts on Auth0? https://auth0.com/
Comment linking /
on “Supabase (YC S20) – An open source Firebase alternative”Submitted Introducing Auth0 Marketplace as a story · 18 points
HN discussionThis is possible if you support the 'jti' claim[1]. There's a discussion of an implementation of it here[2]. [1]: http://self-issued.info/docs/draft-ietf-oauth-json-web-token... [2]: https://auth0.com/blog/blacklist-json-web-token-api-keys/
Comment linking /blog/blacklist-json-web-token-api-keys/
on “Yahoo discloses hack of 1B accounts”Submitted Critical Vulnerability in JSON Web Encryption as a story · 18 points
HN discussionBut they have explicit limits? https://auth0.com/pricing
Comment linking /pricing
on “Cloudflare took down our website”Submitted Using TouchID for Authentication in Your React Native App as a story · 17 points
HN discussionSince the mid 90s Internet Explorer & Netscape had aiff support and autoplay and Javascript 1.0. We had some good times. https://auth0.com/blog/a-brief-history-of-javascript/
Comment linking /blog/a-brief-history-of-javascript/
on “Tell HN: I let my 6-year-old daughter design my website”Submitted Engineering the Design Process at Auth0 as a story · 15 points
HN discussionRather than just "JWT is awesome..." wouldn't it be more sensible and responsible to caveat this with some of the drawbacks? I read this article recently ( http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo... ) that proposes not to use it for sessions but instead for the use cases listed at the end of the article. Follow-up article here http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo... Also…
Comment linking /blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
on “A practical security guide for web developers”Submitted Handling JSON Web Tokens with Angular as a story · 15 points
HN discussionAuth0 ran in six AZs in two regions[1] and went down today[2], because they picked the wrong two regions. How many regions and AZs should someone pay for before they get reliability? 1: https://auth0.com/blog/auth0-architecture-running-in-multipl... 2: https://twitter.com/auth0/status/1471159935597793290
Comment linking /blog/auth0-architecture-running-in-multiple-cloud-providers-and-regions/
on “Tell HN: AWS appears to be down again”Submitted Introducing Auth0 Extend: The new way to extend your SaaS as a story · 14 points
HN discussionBecause I'm an idiot who likes hosting stuff on bad gTLDs, here's the markdown content of the actual post for you and everyone behind some corporate firewall that blocks dot zip: The term "Magic Links" once meant a [futuristic PDA]( https://en.wikipedia.org/wiki/Magic_Link ). Nowdays, companies like [Auth0]( https://auth0.com/docs/authenticate/passwordless/authenticat... ) use it to refer to the slightly-magical fea…
Comment linking /docs/authenticate/passwordless/authentication-methods/email-magic-link
on “Magic/tragic email links: don't make them the only option”Submitted 5 things you can do with Yarn as a story · 13 points
HN discussionAuth0 | REMOTE | Americas Time Zones | Full Time We are looking for developers with product minds to help us fulfill our mission: provide the simplest and most secure identity platform for developers to make the internet safer. You would be working on products such as: - Multi Factor Authentication: https://auth0.com/learn/get-started-with-mfa/ - Anomaly Detection: https://auth0.com/docs/anomaly-detection - Lock: ht…
Comment linking /jobs/product-owner
on “Ask HN: Who is hiring? (June 2016)”Submitted Personal Information Security Guide for Family and Friends as a story · 9 points
HN discussionAuth0 | REMOTE | Full Time | https://auth0.com Auth0 is looking for Infrastructure Engineers to help ensure that our services stay up and running while continuing to rapidly ship software that our customers love. An Infrastructure Engineer is a specialist in creating, deploying and running infrastructure and have a great knowledge of networking, the linux kernel and systems scaling. We are looking for people that ha…
Comment linking /jobs/engineer/infrastructure-engineer
on “Ask HN: Who is hiring? (July 2017)”Submitted Things You Should Know About WebAssembly as a story · 9 points
HN discussionAFAIK Google doesn't encourage it and made some efforts to block it: https://auth0.com/blog/google-blocks-oauth-requests-from-emb... Hasn't been 100% effective unfortunately, and even if it was, it's really hard to make users understand that this flow is incredibly dangerous. And while Google on Android can simply go through system libraries, Facebook doesn't have the option if the app is not installed. They have to…
Comment linking /blog/google-blocks-oauth-requests-from-embedded-browsers/
on “I lost €4k in a Facebook scam”Submitted Blacklisting JSON Web Tokens as a story · 9 points
HN discussionAuth0 ( https://auth0.com/ ) | Seattle - Buenos Aires - Remote | Full-time | Engineering Auth0 is a Series C/285 employee company with major growth plans for 2018. Our vision is to provide the simplest and most secure identity platform for developers, to make the internet safer. Ultimately, we strive for an internet with fewer passwords. We're looking for people to join us on this journey. Open jobs: Engineer, Analy…
Comment linking /blog/how-we-hire-engineers/
on “Ask HN: Who is hiring? (March 2018)”Submitted What Is HTTP/2 All About as a story · 8 points
HN discussion
