Skip to content

7 chapters · 94 minutes

The workshop

From a single sign-on flow you can watch step by step to a database that keeps customers apart on its own. Work through them in order; each ends with a way to check it worked.

  1. 01The mapSSO, OAuth 2.0, OIDC, SAML, roles, tenants, RLS: what each word means, which problem it solves, and a running app that uses them all.10 min
  2. 02The OAuth 2.0 code flow, with PKCEFour steps, two redirects and one server-to-server call. Each parameter exists to stop one specific attack.15 min
  3. 03OIDC ID tokensA JWT is three base64 strings anyone can read and anyone can write. What makes it trustworthy is the five checks you run before using it.15 min
  4. 04SAML in one pageThe XML standard that most enterprise customers still ask for. The same ideas as OIDC, in a different envelope, with sharper edges.12 min
  5. 05Roles and permissionsThe identity provider tells you someone is an admin. Your app decides what an admin may do, in one place, checked on the server.12 min
  6. 06Tenant isolation: find the leakEvery query in a multi-tenant app needs the tenant in it. This app forgot once. Find the leak with a probe, fix it in one line, and prove it.15 min
  7. 07Row-level security, and the enterprise checklistMake Postgres refuse cross-tenant rows on its own, so a forgotten WHERE clause is a bug, not a breach. Then the list enterprise customers will ask you about.15 min