Suggestions
Mike Thornton
Hands-on Software Architect
Mike Thornton is a Principal Engineer/Architect at Pulse Secure, where he focuses on leveraging his leadership and problem-solving skills to enhance software architecture. He has a strong background in software development, architecture, and engineering, which allows him to navigate complex design challenges effectively.4
In addition to his role at Pulse Secure, Thornton is known for his contributions to the software community, including mentoring in areas such as Python and backend development.3 His professional presence is notable on LinkedIn, where he engages with a network of over 500 connections and shares insights on software design and architecture.12
Thornton's expertise spans multiple domains within software engineering, making him a valuable resource for organizations looking to optimize their software solutions.4
Highlights
Your JWT may already be hacked
JSON Web Tokens (JWT) are signed with specific algorithms. The server verifies a JWT is signed by a trusted signer.
Some server implementations are broken.
❌ Allows the JWT to specify any signing algorithm ❌ Uses whatever signing algorithm the JWT specifies
Allowing any algorithm is a serious security risk. "none" is a valid JWT signing algorithm. "none" means no signing.
How the hack works:
🔸 Attacker generates a forged JWT with an admin claim 🔸 Attacker specifies the "none" signing algorithm 🔸 Server allows any algorithm, including "none" 🔸 Server skips verifying the signature; there is no signing algorithm 🔸 Attacker is allowed through
To fix, use an allowlist with specific signing algorithms for your token verification.
Not only does this algorithm allowlist prevent the usage of "none", it prevents an attacker from forcing the server to use a potentially less secure algorithm.
Join my newsletter for more on security and architecture https://lnkd.in/gpGG25TK
Start with a monolith. 🏰
🧠 Keep in mind dependency management, abstractions, and encapsulation, but don’t dwell on them.
Write business case-driven tests. ✅
➠ Componentize into a modular monolith when:
⋅ User needs grow, thus domain complexity increases ⋅ Number of teams grows, thus changes conflict
🧠 Keep in mind minimizing module coupling while maximizing cohesion, but don’t obsess over them.
You know it works after the refactor because your business case tests pass. ✅
➠ Break into separate services when:
⋅ Load grows, thus distribution is needed to scale ⋅ Team autonomy grows, thus independent deployment is needed
🧠 Keep in mind, breaking apart will be much easier since you:
⋅ Effectively managed dependencies, ensuring decoupled modules ⋅ Encapsulated business domains, ensuring high internal cohesion within modules ⋅ Abstracted complex or external systems, ensuring portability
You know it works after the refactor because your business case tests pass. ✅
👍 Like or repost for appreciation 🙌 Follow if this resonates 📭 Get the details by subscribing to Dev Details Substack
#microservices #softwareengineering
