Passkeys in Node.js: Add Passwordless Login to an Express App
Build passkey registration, usernameless login, and browser autofill with SimpleWebAuthn, plus the security checks most tutorials skip.
#authentication
Posts tagged #authentication
Are Passkeys a Trap? Fact-Checking a Viral Warning
A viral Substack post says never use passkeys. I checked its claims: it spots a real long-term risk, but the evidence doesn’t support the headline.
Stop Logging Out Innocent Users: Building Production Refresh Token Rotation with Token Family Revocation in Redis
How to implement RFC 6749 OAuth 2.0 Security BCP in NestJS and Redis with atomic Lua scripts, concurrency grace windows, and SSR-safe session management.
Four Ways a Refresh Token Request Fails — Only One Means Trouble
Invalid, expired, revoked, and reused tokens aren't the same. Build real refresh token reuse detection in NestJS + Postgres—and verify it revokes only the compromised session.
Sign in With Google in Node.js — Without Passport
Build Google OAuth from first principles using PKCE, state validation, secure token exchange, refresh tokens, and JWT sessions in Node.js—without Passport.js or authentication libraries.
Implementing Passkey Authentication in NestJS and PostgreSQL
A practical, code-first guide to adding WebAuthn passkey registration and login to NestJS with PostgreSQL, covering credential storage, challenge handling, security, and production hardening.
