https://blog.yusukeikoma.com/tags/authentication/Recent content in authentication on Ikoma's BlogHugoen-usTue, 15 Sep 2026 13:18:09 +0900https://blog.yusukeikoma.com/posts/step-up-authentication-challenge-is-a-401/Tue, 15 Sep 2026 13:18:09 +0900https://blog.yusukeikoma.com/posts/step-up-authentication-challenge-is-a-401/RFC 9470 lets an API tell a client that its access token was obtained with too weak or too old a login. Reading the RFC section by section, then building a toy server and client, shows what the document specifies (a 401 challenge, two parameters) and the three things it leaves to you: concurrent challenges, loops, and caches.https://blog.yusukeikoma.com/posts/websocket-origin-check-is-not-authentication/Thu, 10 Sep 2026 11:23:25 +0900https://blog.yusukeikoma.com/posts/websocket-origin-check-is-not-authentication/The Origin header on a WebSocket handshake is set by browsers and can be set to anything by every other client. So an allow-list protects a cookie-authenticated browser session from other sites, and it proves nothing about who is connecting. A runnable server, a real headless-browser attack, and the handshake rule that follows.https://blog.yusukeikoma.com/posts/refresh-token-rotation-concurrent-requests/Sun, 30 Aug 2026 13:34:18 +0900https://blog.yusukeikoma.com/posts/refresh-token-rotation-concurrent-requests/Refresh token rotation turns a reused token into a theft alarm. A client that fires three requests with an expired access token and refreshes once per 401 presents the same refresh token three times, and trips that alarm on itself. This post breaks a naive client on purpose, fixes it with single-flight refresh and a stale check, and compares the alternatives: a server grace window, request gating, proactive refresh and sender-constrained tokens.https://blog.yusukeikoma.com/posts/websocket-reauthentication-on-long-lived-connections/Fri, 21 Aug 2026 13:34:18 +0900https://blog.yusukeikoma.com/posts/websocket-reauthentication-on-long-lived-connections/After the 101 response, no request carries credentials: the server remembers a verdict, not the evidence. This article follows one token through a browser handshake, shows what a page can and cannot see, and compares three ways to renew it (reconnect, in-band, out-of-band) with a runnable server, tests, and a headless-Chrome check.https://blog.yusukeikoma.com/posts/separate-authentication-and-authorization/Tue, 11 Aug 2026 17:14:04 +0900https://blog.yusukeikoma.com/posts/separate-authentication-and-authorization/Designing API authentication and role-based authorization with actors, route permissions, and separate credentials for people and machines.