Tag
Security and privacy, in practice
For a month my Keycloak admin console was one HTTPS request from anyone. How I closed it at the Traefik edge, opened a loopback-only door over SSH, and the details that decide whether the tunnel works or locks you out.
Security and privacy, in practice
My Keycloak broker showed a username/password form beside LinkedIn even though LinkedIn was the only supported recruiter identity. Here is how I replaced that ambiguous page with a fail-closed browser flow.
Security and privacy, in practice
I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.