Top all-time · #876
Okta Developer
Company blog · developer.okta.com/blogprogrammingsecurity
Okta Developer is the company blog at developer.okta.com, writing about programming and security. Since 2014, 75 different Hacker News readers have linked it 133 times, most often “Why JWTs Suck as Session Tokens (2017)”. It is still writing: the last post was on 2026-10-09, and you can follow it by feed.
Secure, scalable, and highly available authentication and user management for any app.
Most-linked posts?
- Why JWTs Suck as Session Tokens (2017)7 people · 7 mentions · first linked 2017-08-18
- A Thorough Introduction to Paseto (Secure JWT Alternative)6 people · 7 mentions · first linked 2019-10-17
- What the Heck Is Sign in with Apple?5 people · 5 mentions · first linked 2019-06-04
- An Illustrated Guide to OAuth and OpenID Connect4 people · 4 mentions · first linked 2019-10-21
- Nobody Cares About OAuth or OpenID Connect3 people · 3 mentions · first linked 2019-01-23
- What's New for Node.js in 20202 people · 2 mentions · first linked 2019-12-04
- Using Have I Been Pwned to Prevent Your Users from Using Breached Passwords2 people · 2 mentions · first linked 2018-06-11
- Build a Simple REST API with Node and OAuth2 people · 2 mentions · first linked 2018-08-21
- NoSQL Options for Java Developers, Part II2 people · 2 mentions · first linked 2017-10-10
- IInterface Considered Harmful2 people · 2 mentions · first linked 2019-06-27
What Hacker News says?
I'm thrilled about implementing this on our app so we can make registration and login even more smooth without having to be in bed with Google and Facebook. Can't wait to implement it. I'm even more thrilled to see, that according to the Okta article linked in another thread by simonw [1], Apple uses OAuth and OpenID Connect for this, and not some home-grown protocol. Great news all-round. [1] https://developer.okta…
Comment linking /blog/2019/06/04/what-the-heck-is-sign-in-with-apple
on “Sign In with Apple [video]”Submitted An Illustrated Guide to OAuth and OpenID Connect as a story · 431 points
HN discussionHas anyone seen a live online demo of "Sign in with Apple" anywhere on the internet? I've seen a few tutorials - https://developer.okta.com/blog/2019/06/04/what-the-heck-is-... is particularly good - but no one seems to have deployed a button I can click anywhere yet.
Comment linking /blog/2019/06/04/what-the-heck-is-sign-in-with-apple
on “Sign In with Apple [video]”Submitted Why JWTs Suck as Session Tokens (2017) as a story · 173 points
HN discussionDPoP described in RFC9449 - you can see from the RFC number it's quite new. I don't think there's wide support for it, but at least Okta supports it[1] and I think Auth0 are also working on adding DPoP. Is it good? I'm not a fan. To use DPoP safely (without replay attacks), you need to add server-side nonces ("nonce") and client-generated nonces ("jti", great and definitely not confusing terminology there). You need…
Comment linking /docs/guides/dpop/nonoktaresourceserver/main/
on “Should I use JWTs for authentication tokens?”Submitted Nobody Cares About OAuth or OpenID Connect as a story · 164 points
HN discussionI knew we documented it somewhere: https://developer.okta.com/docs/concepts/api-access-manageme...
Comment linking /docs/concepts/api-access-management/
on “Dear OAuth Providers”Submitted Why JWTs Suck as Session Tokens (2017) as a story · 91 points
HN discussionhttp://developer.okta.com/docs/api/getting_started/design_pr... Good error handling, easy to get started, and they provide Postman collections for each API
Comment linking /docs/api/getting_started/design_principles
on “Ask HN: What is your go-to example for a good REST API?”Submitted What's New in JavaScript for 2019 as a story · 58 points
HN discussion> I haven't seen a self-discoverable REST API ever in the wild I'm super cognizant this entire discussion hinges upon semantics, nuance, etc but the Okta API isn't terrible about that https://developer.okta.com/docs/reference/core-okta-api/#hyp... I haven't personally tried `curl https://$ {yourOktaDomain}/api/v1 ` to see what the bootstrapping process looks like, but I can attest they do return _links in a bunch of…
Comment linking /docs/reference/core-okta-api/
on “How did REST come to mean the opposite of REST?”Submitted If It Ain't TypeScript It Ain't Sexy as a story · 50 points
HN discussionhttps://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-...
Comment linking /blog/2017/08/17/why-jwts-suck-as-session-tokens
on “JWT should not be your default for sessions”Submitted Build a Simple CRUD App with Angular 6 and ASP.Net Core 2.1 as a story · 39 points
HN discussionThey don't call it OAuth/OpenID, but they're using the same terminology and API: https://developer.okta.com/blog/2019/06/04/what-the-heck-is-...
Comment linking /blog/2019/06/04/what-the-heck-is-sign-in-with-apple
on “How Popular Is “Sign in with Apple”?”Submitted Pro Tips for Developer Relations as a story · 27 points
HN discussionI'm curious about Okta's customer facing audit logs. It seems they do offer audit logs [1] [2] but I can't find the documentation on what all events are included and if actions by support are (which they should). Google for example includes transparency events in it's audit log [3], CloudTrail also shows actions taken by AWS support. I've talked about this before [4] but just having internal audit logs doesn't cut i…
Comment linking /docs/reference/api/system-log/
on “Okta’s Investigation of the January 2022 Compromise”Submitted Using Have I Been Pwned to Prevent Your Users from Using Breached Passwords as a story · 24 points
HN discussionhttps://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-...
Comment linking /blog/2017/08/17/why-jwts-suck-as-session-tokens
on “Blitz.js Now in Beta (Batteries Included Framework Built on Next.js)”Submitted Three Developer Tools I'm Thankful For as a story · 13 points
HN discussionhttps://developer.okta.com/blog/2018/06/11/how-to-prevent-yo... ("How to Prevent Your Users from Using Breached Passwords") | https://github.com/OktaSecurityLabs/passprotect-js is an example. Good behavior: > The new NIST recommendations mean that every time a user gives you a password, it’s your responsibility as a developer to check their password against a list of breached passwords and prevent the user from usin…
Comment linking /blog/2018/06/11/how-to-prevent-your-users-from-using-breached-passwords
on “23andMe tells victims it's their fault that their data was breached”Submitted Security Patterns for Microservice Architectures as a story · 12 points
HN discussion> Anyone got insights as to how mainstream Paseto is getting? Okta's a pretty big name in authn/authz and their engineers recently published an open source PASETO implementation. https://developer.okta.com/blog/2019/10/17/a-thorough-introd... https://github.com/paseto-toolkit/jpaseto
Comment linking /blog/2019/10/17/a-thorough-introduction-to-paseto
on “JWT is Awesome”Submitted I made a cli example about the special OAuth 2.0 flow for native and mobile apps as a story · 8 points
HN discussionJNI is the second or maybe third FFI for Java. JRI existed before it and that was worse, including performance. The debugging and instrumentation interfaces have been rewritten more times. https://docs.oracle.com/en/java/javase/24/docs/specs/jni/int... mentions JRI. But it seems like JNI has been replaced by third party solutions multiple times as well. https://developer.okta.com/blog/2022/04/08/state-of-ffi-java...
Comment linking /blog/2022/04/08/state-of-ffi-java
on “Parsing Protobuf like never before”Submitted Show HN: I built a 2FA token from a Gameboy clone as a story · 7 points
HN discussionThe blog mentions right at the start that it's based on OAuth 2.0/OIDC, similar to how you log in to your Google account in Thunderbird for example. > I always wonder how it will work for someone writing their own client, perhaps a very basic client (or a bot). For interactive clients, it'll be the standard OAuth 2.0 Authorization Code flow[1]. For non-interactive services they say in the proposal[2] that one uses t…
Comment linking /docs/concepts/oauth-openid/
on “Matrix.org Will Migrate to MAS”- jf · 2015-12-02
Submitted TLS Client Authentication for Internal Services as a story · 7 points
HN discussion This is cool. I wrote a TOTP authenticator for the ArduBoy: https://developer.okta.com/blog/2018/08/30/build-one-time-pa...
Comment linking /blog/2018/08/30/build-one-time-password-token-for-mfa
on “TOTP Authenticator for PalmOS”Submitted A Thorough Introduction to Paseto (Secure JWT Alternative) as a story · 6 points
HN discussion
