One post tagged with "authentication"

Building modern web applications to be testable while using a best-practice IdP with OIDC can be at odds with a frictionless developer experience. The usual shortcut is to bypass the real auth flow entirely in local/dev environments - stub out a token, hardcode a fake user, skip the redirect dance. It's fast, but it means your local environment is no longer exercising the actual authentication and authorization path your app relies on in production, and that's exactly where subtle bugs like to hide: token validation quirks, issuer/audience mismatches, claims mapping, silent renew, redirect URIs, and so on.