Ever wondered why Node.js single thread? Concurrency vs. Parallelism, Race Conditions, Deadlock, Starvation, Locking (Mutex), Semaphore, Atomic, compare-and-swap CAS, and more. — What is Multithread? (For a better understanding, I recommend a quick recap about what is Thread and Process from this article: Difference between Process and Thread) A Thread is the smallest unit of execution within a process. …

In this article let’s review a very popular interview question: what is the difference between Thread and Process and the reason behind it. — What are Programs, Processes, and Threads? To better understand, first let’s look at what are those. Program A program is a sequence of instructions that a computer can execute or interpret. A computer program in its human-readable form is called source code. Usually, the source code needs to be translated to machine instructions using its language’s compiler…

Understand the passwordless authentication mechanism with this hands-on tutorial — In this article let’s implement a passwordless authentication app by building a FIDO2 server and learning how we can interact with it using WebAuthn API. Also, explore some tips and resources when implementing a passwordless authentication mechanism. FIDO2, WebAuthn and CTAP FIDO2 is comprised of Web Authentication Specification (WebAuthn) from the W3C and Client-to-Authenticator…

For a long time, passwords have been an obvious authentication method. In this article, let’s see what is the issues with passwords, explore how FIDO can set us free from memorized passwords, discover the building blocks of FIDO and answer the question, does FIDO or WebAuthn is Biometric Authentication? Passwords (or Shared Secret) are broken Nowadays…

Let’s figure out how we can terminate all sessions of a user from the Backend to handle Backchannel Logout requests from IdP. — In the previous article, Managing User Sessions and OpenID Connect Logout, we have learned that Backchannel Logout is recommended by other Logout specifications because it’s not affected by blocking third-party cookies. However, we need to have a way to manage the user sessions from the backend, this might be more…

A deep dive into four OpenID connect logout specification — Timely response to policy violations or security issues really requires a “conversation” between the token issuer (IdP) and the relying party (RP). This two-way conversation gives us two important capabilities. The relying party can notice when things have changed (e.g. …

Browsers have introduced several security measures to protect user privacy regarding tracking user activity in the internet. Initially, browsers introduced same-site cookies to control the usage of third-party cookies. However, with recent updates, browsers are moving towards completely blocking third-party cookies. …

How can we make the OAuth flow secure in Single Page Applications (SPA)? In this article, let’s find out what is the potential threats might have when developing Single Page Application (SPA) and best security practices for implementing OAuth 2.0 in SPA. SPAs Common Characteristic / SPAs From OAuth Perspective First, let’s see the common characteristic when doing…

How can we make the OAuth flow secure in Single Page Applications and Mobile App? In this article, let’s have a look at a legacy way to achieve this back in 2010 and see how it evolved to today’s best practices. First, you should have a little background about OAuth…