Articles
Release notes, design decisions and notes from the libraries.
-
What a service worker must never cache
Caching the wrong response does not produce an error. It produces a wrong answer, delivered confidently, for as long as the cache lives.
-
Making a Symfony application installable, without a framework for it
A progressive web app needs a manifest, a service worker and a few icons. Most of the work is deciding what should happen offline.
-
Web push notifications from PHP, without a service in between
A push subscription is a URL, a public key and a secret. Everything else is your server talking directly to the browser vendor.
-
What the six digits of a TOTP code actually are
A time-based one-time password is a truncated HMAC of the current half-minute. Understanding that explains every design decision you have to make around it.
-
Certificates in PHP, or what ASN.1 asks of you
X.509 is a data structure before it is a trust model. Reading one properly means meeting ASN.1, DER, and a few decisions made in 1988.
-
Passkeys: what actually changes for your PHP application
Passkeys are Webauthn credentials that sync. That single difference changes your data model, your recovery flow and what you can promise your users.
-
CBOR, and why Webauthn insisted on it
A binary format that looks like JSON but is not. If you touch Webauthn, you will meet it, and it helps to know why it is there.
-
Attestation: when you need it, and when it costs you
Attestation tells you what kind of authenticator a user holds. Most applications should ask for none, and the reasons are worth spelling out.
-
The Webauthn authentication ceremony, and what to store
Signing in is shorter than registering, but the checks are just as strict. What your database needs to hold, and what to do with the sign counter.
-
The Webauthn registration ceremony, step by step
What actually happens between clicking « add a security key » and having a credential you can trust. Six steps, and the three where implementations go wrong.
-
Bridging two ecosystems rather than forking one
LexikJWTAuthenticationBundle handles authentication. JWT-Framework handles JOSE. A bridge is a hundred lines; a fork would have been a second project to maintain.
-
Rotating signing keys without breaking anyone
Key rotation is four steps and one waiting period. Skipping the waiting period is what turns a routine operation into an incident.
-
Signed, encrypted, or both? Choosing what a JWT should be
A signed token proves who wrote it. An encrypted token hides what it says. They answer different questions, and the answer is not always “both”.
-
Understanding JSON Web Tokens: verifying properly
A valid signature is the first check, not the last. The claims that must be verified, the ones people forget, and the order to do it in.
-
AES-GCM, and the one thing you must never do with it
Galois Counter Mode gives you encryption and authentication in one pass. Reuse a nonce once and you lose both, permanently.