June 2025 Summaries

Viam, a software platform aimed at simplifying hardware development, partnered with FusionAuth to enhance its authentication processes, crucial for managing sensitive IoT data such as home security and personal device information. FusionAuth's multi-application architecture and single-tenant security model provided Viam with the ability to manage both direct platform users and customer end-users effectively while ensuring data isolation and security. This collaboration allowed Viam to offer authentication as a managed service, thereby removing the complexity of identity management for its customers and supporting their growth from startups to larger enterprises. Rapid migration and responsive support from FusionAuth ensured a seamless transition, enabling Viam to focus on accelerating its customers' business development. Looking ahead, Viam is exploring features like passwordless authentication and multi-factor authentication to further simplify user experiences and enhance security.

The article explores the security challenges associated with storing OAuth tokens in client-side applications, such as single-page applications (SPAs) and mobile apps, and suggests using an OAuth proxy server, also known as the backend for frontend (BFF) pattern, to mitigate these risks. The BFF pattern was introduced to streamline app development by creating a dedicated backend for each frontend, reducing the complexities of managing a single API across multiple platforms. This pattern enhances security by ensuring that sensitive tokens are handled by a trusted server rather than being exposed to potential client-side vulnerabilities like cross-site scripting (XSS) and cross-site request forgery (CSRF). The article highlights the importance of using HttpOnly cookies for storing credentials and discusses the implementation of OAuth authorization code flow with PKCE to further secure token exchanges. It also presents practical examples of setting up a BFF using FusionAuth and Passport.js, emphasizing that while serverless architectures allow for flexibility, they come with significant security risks that can be mitigated by adopting a BFF approach.

Powerful Medical, a healthcare technology company specializing in cardiovascular diagnostics, faced significant challenges in scaling their authentication system to meet the stringent requirements of healthcare enterprises. As they transitioned from serving individual users to enterprise healthcare institutions, they needed a solution that provided on-premise deployment, single-tenant security, and seamless integration with CI/CD pipelines. AWS Cognito, their previous provider, could not meet these needs, prompting a search for a more robust solution. FusionAuth emerged as the only provider capable of fulfilling all their requirements, offering features such as SSO, SCIM provisioning, multi-factor authentication, and comprehensive protocol support, while ensuring compliance with healthcare regulations like HIPAA. The adoption of FusionAuth allowed Powerful Medical to accelerate customer onboarding, enhance engineering productivity, and ensure universal compatibility with healthcare enterprises, ultimately transforming authentication into a key driver for revenue growth and enterprise deal closure.

The article explores the impact of multi-tenant and single-tenant designs on the scalability of software architecture, emphasizing the benefits and drawbacks of each approach. Single-tenant architecture, as exemplified by FusionAuth, offers predictable performance under load, enhanced security through data isolation, and a straightforward horizontal scaling process via its stateless design, making it suitable for handling high-volume applications and ensuring compliance with data residency requirements. In contrast, multi-tenant systems allow for serving multiple customers on shared infrastructure, which is cost-effective but poses security risks and performance challenges due to potential load spikes from "noisy neighbors." The text also highlights the importance of considering scaling strategies, such as vertical and horizontal scaling, to accommodate growing user bases and address authentication bottlenecks caused by CPU-intensive processes like password hashing. Various real-world examples, including the failures of Pokémon GO and ChatGPT to scale effectively, underscore the necessity of preparing for sudden traffic spikes and maintaining infrastructure that can handle peak loads to prevent service degradation and protect user data.

Large language models (LLMs) are increasingly being used by developers to write code and discover tools, with over 97% of GitHub developers using AI coding tools. To help LLMs and developers use documentation effectively, companies can modify their docs to make them work better with LLMs. This can be achieved through building great docs that are well-structured, up-to-date, and consistent, or by deploying an AI-powered documentation assistant (chatbot) that provides a convenient interface for users. Another option is to generate an `llms.txt` file, which helps LLMs discover and ingest content, and includes features like semantic density and markdown text. Finally, adding a "copy to markdown" button allows developers to leverage LLMs in a similar way to providing the full documentation, making it easier for them to use the docs effectively.

WeRoad, a European adventure travel company, faced authentication challenges as it rapidly expanded. The DevOps team needed a single sign-on solution that worked across multiple applications, supported social login, mobile app authentication, machine-to-machine authentication, passwordless options, and maintained data sovereignty for GDPR compliance. After evaluating several authentication solutions, WeRoad selected FusionAuth due to its cost-effective scaling, self-hosting capability, simplified deployment, comprehensive feature set, and customization options. Since implementing FusionAuth in 2021, WeRoad has experienced substantial cost savings, enhanced data control, easy maintenance, scalable authentication, and seamless integration into their infrastructure-as-code practices.

Mocking authentication in software development allows for faster testing, reduced infrastructure costs, and simplified testing flows that rely on external systems. However, it's essential to determine when mocking is justified and when it might introduce risks or gaps in testing. The article provides guidance on identifying scenarios where mocking auth makes sense, such as bypassing the login flow entirely, simulating edge cases or error scenarios, or dealing with large system complexity. When mocking auth doesn't make sense, it's often due to highly regulated environments, systems with strict security requirements, or contexts where real-world behavior is needed. In these situations, integration tests that validate real tokens and include MFA flows are recommended instead. The article concludes by emphasizing the importance of knowing when to use mocking auth and being mindful of its limitations.

Bilt, a housing and neighborhood commerce network, faced challenges in choosing a CIAM (Customer Identity and Access Management) solution that met its requirements for scalability, security, and affordability. The company needed a solution that could serve millions of users, deploy to Google Cloud Engine (GCE), integrate with their CI/CD pipeline, and keep all data within the Google Cloud environment. After evaluating options, Bilt found that many pure multi-tenant SaaS CIAM solutions lacked robust features or met security posture requirements but were too rigid in deployment options. Cost predictability was another sticking point, as most solutions used billing models that became unpredictable with growth. Bilt ultimately chose FusionAuth for its flexibility, performance, and affordability, which allowed them to scale on-demand, maintain operational sovereignty, and integrate seamlessly into their CI/CD pipeline. With FusionAuth, Bilt has been able to handle millions of users without issues, while maintaining predictable costs and direct access to expert support.