#keycloak

Security and privacy, in practice

I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.

• #spring
• #keycloak
• #security
• #oauth2

Working with Claude Code

Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.

• #spring
• #security
• #keycloak
• #claude-code
• #oauth