Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
JWT in Depth: JWS and JWE, Algorithm Choice, kid, JWKS and Signing Key Rotation
Seamless signing key rotation takes three steps: publish the new key in the JWKS, wait until the APIs' caches refresh (12 hours by default), then sign with it and retire the old key once token lifetimes pass. We show JWS versus JWE, choosing ES256, alg none and algorithm confusion attempts, typ validation with at+jwt, kid and JWKS, the 8725bis draft's warnings and claim bloat with real outputs.
Refresh Tokens: Rotation, Reuse Detection, Revocation and Secure Server-Side Storage
A refresh token should be replaced on every use, and if a consumed token comes back, the whole token family of that sign-in should be revoked; RFC 9700 requires this or sender-constrained tokens for public clients. With EF Core and SQLite we build SHA-256 hashed storage, atomic consumption with ExecuteUpdate, reuse detection, the two-tab race, sliding and absolute lifetimes and signing out of all devices with real outputs.
Protecting the API: Access Token Validation, Audience, Scope Policies, Client Credentials and DPoP
An API must accept not every validly signed token, but only one issued for its own audience and carrying the required scope. We wire AddJwtBearer to Keycloak, map scopes to policies, use introspection to show why a signed-out user's JWT still passes, write a DelegatingHandler that caches client credentials tokens, and verify in five scenarios that a stolen DPoP-bound token is useless.