March 2025 Summaries

To add Login with Slack functionality to an app using Node and WorkOS, install the WorkOS Node SDK, set up secrets such as API keys and client IDs, configure a Slack connection by getting a Redirect URI from the WorkOS dashboard and setting it in the Slack OAuth app, provide client credentials to WorkOS, configure a redirect URI, set up a frontend with React and add code to handle user authentication, set up a backend using Express, direct users to sign in or sign up using AuthKit, extract the authorization code, exchange it for an access token, and use the user's profile information. This is just the first step in identity management and involves handling the user session, implementing logout, adding SAML SSO, implementing access control, provisioning users automatically, handling failed authentication events, and more.

Spring Launch Week has brought exciting updates to WorkOS, including the launch of WorkOS Connect, which allows customers to seamlessly connect to your application. This new feature supports three use cases: "Sign in with [Your App]", Identity Delegation, and Customer API Access. Additionally, WorkOS Vault simplifies encryption and sensitive data management for modern web applications. AuthKit has introduced Custom Metadata, External ID, and JWT Templates for more customization and control over integrating authentication into your application. New enterprise login integrations are also available in AuthKit, including support for eight built-in providers. Furthermore, new widgets have been added to provide out-of-the-box support for common enterprise app features, such as the User Profile and Organization Switcher widgets.

To add Login with GitLab functionality to an app using Node and WorkOS, developers need to follow a series of steps. First, they must install the WorkOS Node SDK and set environment variables for authentication. Next, they need to configure a connection between their app and GitLab OAuth by creating an application on GitLab's side and copying specific values from the WorkOS dashboard. After that, they have to provide client credentials to WorkOS, configure a redirect URI, and set up the frontend to display a login link. Finally, they must implement backend logic using AuthKit to handle user authentication, extract authorization codes, exchange them for tokens, and manage user sessions securely. This tutorial provides a comprehensive guide for integrating Login with GitLab into an app using Node and WorkOS, but some steps may become outdated as products evolve.

Credential stuffing and brute force attacks are two types of cyber attacks that can compromise digital platforms. Credential stuffing involves using stolen usernames and passwords to gain access to multiple accounts, while brute force attacks involve systematically guessing every possible combination of characters to break a password or encryption key. Both attacks differ in their approach, with credential stuffing exploiting the common habit of password reuse and brute force attacks focusing on systematic guessing. To defend against these attacks, individuals and organizations can implement measures such as multi-factor authentication, strong password policies, CAPTCHA, monitoring and limiting login attempts, educating users, account lockout mechanisms, and using advanced security features like WorkOS Radar that provide risk-based authentication, anomaly detection, intelligent rate-limiting, bot detection, stale accounts monitoring, user behavior analytics, adaptive authentication, impossible travel blocking, and more.

You can add Login with LinkedIn functionality to your app using Node and WorkOS. To do this, you'll need to install the WorkOS Node SDK, set secrets such as API keys and client IDs, configure the LinkedIn connection by creating an OAuth app on LinkedIn's Developer Portal, provide client credentials to WorkOS, configure a redirect URI, and set up the frontend and backend using React and Express respectively. After completing these steps, you can handle the user session, implement logout, add SAML SSO, implement access control, and more. This tutorial provides a step-by-step guide on how to achieve this integration.

In this article, several popular authorization models are discussed to help choose the right fit for your SaaS app's security and user management. The most basic form of access control is using roles, which can be suitable if users only need to be separated into broad categories with minimal overlap between roles. However, role-based systems can be too restrictive in smaller companies or startups where roles are more fluid. An alternative approach is to use roles and permissions, which adds granularity by defining specific actions users can perform within the app. This model is useful when there is a significant overlap in access rights between different roles but some variations. Another option is attribute-based access control (ABAC), which decides access based on user attributes or resource attributes, creating a more flexible and dynamic system. Relationship-based access control (ReBAC) focuses on the relationships between users, resources, and other entities, often used in social media platforms, collaboration tools, or enterprise systems. Policies are rule-based models that define access control using logical statements or expressions, allowing for fine-grained, dynamic, and customizable access control. Finally, Fine-Grained Authorization (FGA) combines all these approaches, offering a comprehensive, flexible, and fine-grained authorization model suitable for complex applications with diverse and constantly changing access control requirements.

Zod is a TypeScript validation library that creates a bridge between compile-time type systems and JavaScript's runtime environment. It allows developers to define schemas, which are used to validate data at runtime, transform validated data into properly typed objects, generate TypeScript types, and ensure that AI outputs adhere to defined structures. Zod has become the backbone of structured data handling in the AI ecosystem due to its ability to enforce data contracts, provide clear error messages, and maintain runtime type safety. By integrating with popular platforms like OpenAI, Zod enables developers to build reliable, accurate, and secure AI systems that can generate dynamic user interfaces, create JSON structures following specific business rules, and ensure complex nested data structures are validated before use in production systems. With its minimal dependencies, developer-friendly API, functional approach, and versatile implementation, Zod is a must-know library for developers working at the intersection of TypeScript and AI.

Device fingerprinting has evolved beyond its traditional use case of fraud prevention, expanding into security and personalization use cases such as risk-based authentication, session integrity, and seamless personalization. As regulations like GDPR and CCPA tighten expectations around data collection and retention, companies must approach fingerprinting with care to ensure privacy-first approaches. Storing raw device fingerprints can expose users to risk, so hashing the fingerprint using a stable algorithm is essential. Companies should clearly state what fingerprinting data is collected, why it's collected, and how it's used in their privacy policies, and obtain explicit user consent for non-security use cases. The next frontier of device intelligence is behavior, with high-entropy identifiers generating fingerprints that are more robust against spoofing and less likely to overlap across users. Fingerprinting has become a foundational tool for secure, seamless digital experiences, but its responsible use requires collecting what's needed, obfuscating what's stored, and being honest about what's done.

The rise of AI agents creates a tension in system design, requiring frictionless access while maintaining robust controls and limitations. Authentication methods for AI agents face unique challenges, including accessing multiple systems programmatically, maintaining persistent access without human intervention, and securing credentials and other secrets. The traditional boundaries between human and programmatic access are blurring as advanced AI models interact with systems through user interfaces rather than APIs alone. Organizations must rethink authentication paradigms to balance security with operational effectiveness, considering best practices such as managed identity services, robust credential rotation, and minimal privilege models.

More folks are picking up coding than ever before thanks to advancements in AI. When using AI tools, it's essential to never delegate understanding and be responsible for the architecture, data flow, and each component's role. This means using AI to speed things up but not replacing real comprehension. Additionally, providing explicit "What" and "How" when prompting AI helps keep code generation aligned and avoids wasted cycles on irrelevant scaffolding. Context is also crucial, as AI shines when it has context, including system constraints, environment variables, project structure, and more. Creating a Spec or "Grounding" file that outlines the system becomes your source of truth, especially when using AI tools that support file referencing. Using Git as an ideal save system before writing any code helps track thinking over time, create meaningful milestones, and roll back changes if needed. Finally, understanding the tech first is vital to avoid missing subtle mistakes in the output, so it's recommended to use the model to teach yourself what you don't know.

The security researcher responsible disclosure of a vulnerability in Next.js, CVE-2025-29927, allows an attacker to bypass Next.js middleware entirely through middleware header manipulation. The vulnerability works by manipulating the `x-middleware-subrequest` header added by Next.js middleware to track and prevent infinite loops. An attacker can exploit this with a simple curl command, potentially leading to unauthorized access to routes protected by middleware. Developers using Next.js middleware for authorization or other security controls should upgrade immediately, while users on Vercel are protected but still recommended to upgrade. AuthKit NextJS itself does not need to be updated, and layered security is still the best practice. Upgrading to patched versions of Next.js can protect apps properly, and implementing route-level checks with `withAuth` as a defense-in-depth measure is also recommended.

n8n is a low-code, event-triggered workflow automation tool built with Node.js that enables users to orchestrate logic, connect services, and scale pipelines with minimal boilerplate. It offers a visual interface where users can connect nodes - each representing a step in a process - to create workflows that respond to events, run on schedules, or execute on demand. n8n is open-source and fully self-hostable, giving teams full control over data, system behavior, and deployment, with features such as hundreds of integrations, strong community support, and the ability to extend the platform however needed. The tool supports both real-time triggers and scheduled tasks, making it adaptable to nearly any automation use case. n8n's open-source model has fostered a vibrant community, where users can access public workflows, contribute new nodes, bug fixes, and guides, or get help building custom integrations. With its visual interface, LLM readiness, and strong API support, n8n stands out as a developer-first, open-source automation platform that scales from side projects to mission-critical workflows.

WebAuthn is a web standard for secure authentication that allows users to authenticate to websites and services without the need for a password. It uses public-key cryptography, biometric data, or physical security keys to prove identity, offering enhanced security, passwordless authentication, resistance to credential stuffing and brute force attacks, improved user experience, widespread support, but also challenges such as compatibility issues, user experience limitations, security key availability, backup and recovery concerns, privacy worries, adoption difficulties, and complexity for developers. Implementing WebAuthn requires a server library, user registration flow, and client-side authentication using the Web Authentication API. To ensure a smooth user experience, it is essential to provide fallback mechanisms, secure connections, verify data properly, consider backup methods, test compatibility, and simplify the implementation through third-party services like WorkOS.

The AuthKit team has released four new widgets, including User Profile, User Security, User Sessions, and Organization Switcher, to make building enterprise apps easier. These drop-in components are built on Radix and offer a convenient way to display key user information, manage security settings, view active sessions, and switch between different organizations or accounts within an app. The new widgets can be installed with npm and configured as allowed web origins in the Authentication section of the dashboard. Users can customize the UI using CSS or Radix themes to match their application's aesthetics. These new widgets are now available for free to all AuthKit customers, allowing them to focus on what truly matters - building essential components for their enterprise app.

AuthKit, a platform for B2B SaaS applications, has expanded its support to include 8 new login providers, including Slack, GitLab, Bitbucket, Xero, Rippling, ADP, and Intuit, in addition to its existing providers such as Google, GitHub, Microsoft, and Apple. This move aims to provide enterprise customers with seamless authentication options using their existing infrastructure, reducing friction and streamlining workflows. By supporting multiple login providers, businesses can leverage their existing tools for authentication, making it easier for users to sign up and engage with the platform. AuthKit's expanded support also enables new business opportunities with key providers, such as Xero and Rippling, which are essential tools in various industries. The platform allows users to configure any supported provider from the WorkOS dashboard, providing a flexible and customer-driven solution.

Custom metadata allows WorkOS to store custom string values on users and organizations, enabling applications to access context directly from authentication responses without disruption. JWT templates provide flexibility in customizing session JSON web tokens with metadata and claims, allowing developers to balance snappy retrieval of data with network round trips. External IDs simplify migrations by providing a unique identifier for users and organizations that can be used across existing authentication systems. These capabilities work together to deliver essential metadata directly from WorkOS, enhancing the overall developer experience.

Laravel Cloud is a new platform that simplifies deployment and management of Laravel applications in a scalable, serverless environment. To deploy an enterprise-ready authentication system, users can set up a Laravel 12 project with WorkOS AuthKit, leveraging zero-config hosting and features like social logins, passkeys, Magic Auth, and SSO. The guide outlines six steps to complete the setup: installing Laravel 12 with WorkOS AuthKit, configuring WorkOS in Laravel, setting up redirects in WorkOS, choosing authentication methods, syncing the AuthKit session timeout, and deploying to Laravel Cloud. By following these steps, users can quickly add enterprise-grade authentication features to their Laravel applications, saving time and development effort.

WorkOS Vault is an advanced Encryption Key Management (EKM) service designed to simplify the complexities of secure data encryption and storage. It simplifies key generation and envelope encoding, allowing developers to focus on basic CRUD operations in their application code without requiring expertise in cryptography or encryption key infrastructure. The platform integrates seamlessly with public cloud KMS vendors and enterprise HSMs, providing industry-leading encryption standards for protecting sensitive data such as passwords, API keys, OAuth credentials, customer PII, and credit card numbers. WorkOS Vault offers a suite of APIs designed to cater to various use cases, providing flexibility and control for developers integrating encryption into their applications. It also supports Bring-Your-Own-Key (BYOK) for ultimate data control, allowing customers to use their own encryption keys instead of relying on third-party vendors. The platform includes robust auditability features, enabling full transparency and control over sensitive data access and management.

WorkOS Connect is a unified interface that simplifies authentication and authorization across customers, partners, and external SaaS tools by providing an end-to-end authentication solution for three common product expansion use cases: allowing third-party developers to authenticate with your application via OAuth 2.0, leveraging one identity layer across all your first-party surfaces, and standardizing customer API access via machine-to-machine tokens. With WorkOS Connect, users can be authenticated and signed in across multiple applications and vendors using a single identity service, and credentials can be provisioned for customers using the OAuth 2.0 client credentials grant to enable secure API access. By enabling these integrations, WorkOS Connect helps build this correctly to avoid security issues and provide a great experience for users and partners.

The Model Context Protocol (MCP) is an open specification that simplifies connecting AI models to external tools and data sources. By implementing a custom MCP server, developers can expose data resources in a read-only way, define tools for the AI to call with actions or run functions, and optionally include prompts to standardize messages and tasks. A complete working weather server example demonstrates how to set up a Node.js project, implement a custom MCP server using the modelcontextprotocol TypeScript SDK, review the code, connect it to Claude Desktop, and try it out. The MCP lifecycle is explained, including how Claude reads the configuration file, spawns the server process, connects stdio pipes, announces its capabilities, receives requests, processes them, and displays the results to the user. Next steps include adding more tools, resources, using SSE transport, experimenting with prompts, and integrating the custom server with other MCP clients.

The SAMLStorm vulnerability in xml-crypto and Node.js libraries allows attackers to forge SAML authentication responses, potentially granting unauthorized access to any user account in affected applications—including admin accounts—without any user interaction. This flaw enables full account takeovers across organizations relying on SAML-based single sign-on (SSO). WorkOS immediately patched the vulnerability for all customers within 24 hours, ensuring no WorkOS-integrated applications remained exposed. The vulnerability affects libraries with over 500k weekly downloads, including @node-saml, samlify, and others. To protect themselves, companies should update to the latest version of xml-crypto and review their SAML logs for signs of exploitation. Long-term recommendations include regularly reviewing exposure to protected applications, choosing vendors that support security audit logging capabilities, and ensuring tenants are properly isolated with principle of least privilege applied to IdP's. WorkOS rapidly responded to the issue, patching it within 24 hours and disclosing its findings publicly.

Manus is a general AI agent designed to run asynchronously in the cloud, handling tasks such as resume analysis and job skill recommendations with unprecedented autonomy. It operates using a multi-agent architecture, breaking down complex workflows into smaller parts and delegating them to specialized sub-agents. Manus provides real-time transparency through its "Manus's computer" side panel, which shows the steps it takes to complete tasks, and offers replayable sessions for debugging and review. The system is currently in private beta and has demonstrated how AI can move beyond simple conversations to automate key workflows such as recruiting and finance. Its creators plan to make parts of its framework publicly available, enabling community-driven experimentation and accelerating standard practices across AI development.

The GAIA benchmark is a robust methodology for evaluating AI agent performance across complex tasks. It assesses agents using multiple dimensions such as task execution, adaptability, collaboration, generalization, and real-world reasoning. The benchmark consists of 466 curated questions spanning different complexity levels, with answer validation based on factual correctness. It focuses on tasks that humans find simple but require AI systems to exhibit structured reasoning, planning, and accurate execution. GAIA provides a standardized evaluation methodology for researchers and businesses to determine agent suitability, risk assessment, and human-AI integration. The benchmark bridges gaps in existing benchmarks by incorporating tasks that require web browsing, numerical reasoning, document analysis, and strategic decision-making, making it more relevant than ever for evaluating true artificial general intelligence (AGI).

The article explains the importance of token security in web applications using JSON Web Tokens (JWTs). It introduces four key technologies: JWS (JSON Web Signature), JWE (JSON Web Encryption), JWK (JSON Web Key), and JWKS (JSON Web Key Set). These technologies work together to ensure the integrity, confidentiality, and authenticity of JWTs. The article provides a detailed explanation of how each technology works, including signing, encrypting, verifying, and managing keys. It also covers when to use each technology based on security requirements. Understanding these technologies is essential for securing web applications and protecting sensitive data.

OAuth vulnerabilities exist due to common attacks such as token theft, code injection, mix-up attacks, and more. To prevent these attacks, it's essential to validate redirect URIs, use secure storage for refresh tokens, implement strong client authentication and user authentication, and follow best practices like using PKCE, avoiding implicit grant and ROPC flows, and educating developers on OAuth security. Additionally, using secure libraries and frameworks can help ensure the protocol is implemented securely.

Cursor Rules are instructions passed to large language models (LLMs) by Cursor, allowing developers to codify foundational decisions in their codebase and tailor suggestions or completions to match their team's coding style and best practices. These rules can be attached at various points in the codebase based on file paths or patterns, providing granular control over cursor's behavior. Each rule includes a description of when it should be applied, allowing for matching entire directories or specific file types using glob patterns, as well as referencing other files via @file directives. Automatic attachment enables rules to be applied when opening or modifying files that match certain rules. The .cursor/rules directory is used to store these rules, with the option to create new rules through the Cursor command palette or migrate from an older .cursorrules file structure. Global rules can also be set up in Cursor's global settings for projects that require consistent application across multiple repositories. Additionally, developers can share their best practice rules through community-driven sites and follow tips such as keeping rules granular, version controlling them, and iterating and refining them to address recurring challenges or style preferences.

Composio.dev is a developer-focused integration platform that simplifies how AI agents and large language models (LLMs) connect with external applications and services, allowing teams to focus on functionality and user experience instead of complicated integrations. The platform provides an agentic integration framework, unified configuration and management, a developer-first approach, scalability and reliability, and addresses security and compliance needs. It includes features such as discover and fetch tools, LLM-driven tool calls, context updates, and can be installed and configured using CLI and SDKs. Composio.dev highlights how teams quickly streamline integration tasks and deliver real value in use cases and case studies.

JavaScript tagging is a method used to detect and track malicious bot activity on websites by analyzing user behavior, mouse movements, scroll patterns, and other interactive elements. This technique involves embedding small pieces of JavaScript code into web pages that allow site owners to gather data and differentiate between human users and automated bots. By tracking specific behaviors that are difficult for bots to replicate but natural for human users, such as interaction speeds, mouse movements, and overall behavior, websites can identify potential bot activity and take measures to prevent it. However, JavaScript tagging has its limitations, including privacy concerns and performance overhead, and should be used in conjunction with other detection techniques to provide a robust defense against automated threats. Implementing behavioral analysis with other security measures can help protect websites from scraping, fraud, and other malicious activities, ensuring a safe and seamless user experience.

Identity tokens are used to convey information about a user's identity, including their unique ID, email, and name, and are typically returned to the client application after successful login. Access tokens, on the other hand, are primarily used for authorization purposes, such as accessing protected resources, and contain claims like permissions or scopes that define what the user can do. Properly separating identity tokens and access tokens is crucial for building secure authentication and authorization flows, and mixing them up can expose security holes. Best practices include using identity tokens to personalize applications and display user information, and using access tokens to call APIs while scoping their permissions carefully.

Claude Code is an agentic developer tool built on the 3.7 Sonnet model that enables integrated, AI-powered interactions in the terminal for streamlined development. It can handle tasks such as editing files, fixing bugs, explaining architecture and logic in natural language, handling routine tasks like testing and linting, interacting with Git, and more, reducing cognitive overhead by allowing developers to describe what they want in plain English and having Claude Code execute the necessary actions. Powered by the 3.7 Sonnet model, which adapts dynamically based on the prompt and available "thinking budget," Claude Code prioritizes practical development tasks such as code planning, debugging, and refactoring, making it a valuable asset for engineers working in production environments. While not free, with ongoing costs and a research-preview status, Claude Code is gaining traction among developers who are testing its limits and weighing whether its capabilities justify its price, potentially setting a new standard for AI-powered coding assistants if continued refinements are made.

The Model Context Protocol (MCP) is an open standard developed by Anthropic that connects AI assistants to systems where data actually lives, such as content repositories and business tools. It provides a universal protocol for accessing context between AI models and systems, allowing developers to build once and reuse integrations across multiple LLMs and clients. MCP aims to simplify the integration process, reduce fragmentation, and promote sustainability by providing a standardized directory of capabilities. The protocol enables secure, standardized connections, on-demand access, and seamless collaboration among different data sources. It also fosters an ecosystem of reusable connectors, making it easier for developers to build integrations without rewriting code in multiple ways. As MCP adoption grows, it is expected to reshape common development and AI usage patterns, leading to more agent-led integrations, standardized governance and logging, and streamlined integration processes. The protocol has the potential to set up a future where context-aware AI is the default, with data always just a tool call away.

Application-level encryption is becoming increasingly important as traditional database encryption no longer provides sufficient protection against advanced threats. This approach encrypts data directly within applications, before it reaches databases or networks, offering end-to-end security across systems, granular control over data access, and protection against insider and third-party vendor threats. Implementing application-level encryption requires careful planning, including a secure key management architecture, performance optimization techniques, minimizing exposure of decrypted data, and ensuring data integrity. As regulations like GDPR and CCPA impose stricter controls on personal data, application-level encryption will become mandatory, making it crucial for businesses to adopt this approach to effectively fight against modern cyber threats.

</doc>` OAuth 2.0 is a secure protocol designed to provide access delegation without exposing user credentials. However, its implementation can be prone to security flaws if not done correctly. The IETF published RFC 9700: Best Current Practice for OAuth 2.0 Security, which outlines best practices to follow to keep the OAuth implementation safe. These best practices include protecting redirect-based flows by validating redirect URIs carefully, preventing token replay attacks using short-lived access tokens and secure storage, limiting access token privileges, avoiding password-based authentication and the Implicit Grant, using strong client authentication methods, and staying updated on threats and countermeasures. By following these guidelines, developers can ensure that OAuth 2.0 remains a secure choice for delegated access in modern applications.

The February updates from WorkOS bring several improvements and new features, including the FGA Playground, which allows developers to design and test FGA schemas with ease. Additionally, notifications for SSO connection issues are now sent directly to IT admins, reducing downtime and allowing self-resolution of issues. An official AuthKit starter kit is also available in Laravel Cloud, providing enterprise authentication with minimal setup. Furthermore, the WorkOS Dashboard includes a new notifications page and bell icon, keeping teams informed about important updates. User impersonation support for frontend sessions has been added, enabling team members to log into products as if they were users, speeding up support and debugging while maintaining security.

FGA and ABAC are two distinct authorization models used to manage access in modern access control systems. FGA is a comprehensive framework that integrates multiple authorization models, including Attribute-Based Access Control (ABAC), Relationship-Based Access Control (ReBAC), and Role-Based Access Control (RBAC). It enables organizations to define permissions based on various factors such as user attributes, resource properties, environmental context, and relationships between entities. In contrast, ABAC is a specialized model within FGA that governs access exclusively through attributes associated with users, resources, actions, and environmental conditions. While ABAC can be difficult to manage due to the need to track and update relevant attributes, FGA systems make it easier by using modular policies, allowing teams to combine different models when needed. The choice between FGA and ABAC depends on the organization's specific needs, with FGA often coming out on top due to its ability to integrate multiple models and adapt to complex scenarios. Additionally, both models have their strengths in terms of security, performance, and scalability, but also present challenges such as managing complexity and maintaining up-to-date data. As digital ecosystems grow more interconnected, the fusion of these models powered by advances in centralized policy engines and real-time data pipelines will define the next generation of access control systems.

JWTs are compact, URL-safe tokens that contain a set of claims and are used for authentication and authorization purposes. Storing them securely is crucial to prevent attackers from gaining access to sensitive data. The best practices for storing JWTs securely include using secure transport, short-lived access tokens, rotating refresh tokens, using secure cookies, preventing XSS attacks, implementing token expiration and revocation, considering in-memory storage for sensitive data, and protecting against CSRF attacks. Always serve your application over HTTPS and ensure that sensitive data is encrypted in transit. Implementing a Content Security Policy (CSP) can also help restrict the execution of unauthorized scripts. By following these best practices, you can keep your JWTs secure and ensure that your application remains safe from common attacks.

Hitting product-market fit (PMF) at WorkOS was a transformative experience, marked by a surprisingly broad range of real use cases and the shift from straightforward "how-to" questions to strategic inquiries about enterprise adoption. The company's early success was fueled by its ability to make customers happy, with a usage-based revenue model that only charges customers when they're truly satisfied with the product. PMF is not just a static moment but an ongoing dialogue with users, and it requires continuous communication, iteration, and adaptation to remain relevant. Key takeaways include focusing on smaller, scrappier teams, making 10 initial customers truly love the product before scaling, tying revenue to usage, and maintaining a beginner's mindset to stay close to customers and continue innovating.