Topic · 6 stories
6 stories tagged authentication on AI Tamer, newest first.
An OpenShell gateway with no auth configured gave every caller admin rights. A fix merged on 27 October makes it refuse to start unless you opt in.
GitHub may require sign-in for some anonymous HTTPS clones and fetches of public repos during unusual traffic. SSH, pushes and authenticated Git still work.
Proof Key for Code Exchange ties an authorization code to a secret the client created. Following that secret through the flow shows why a stolen code is insufficient.
Discoverable passkeys let sign-in start with credential selection. The site identifies the account from the response and verifies it.
Cloudflare's 1 October 2026 changelog says workers-oauth-provider v1 can run token issuing and an MCP resource server in separate Workers, with MCP's July 2026 client-metadata flow. npm shows 1.0.0 on 24 September.
Use BroadcastChannel to update open tabs after logout. Keep session invalidation on the server and account for storage partitions and missed messages.
