In the previous Keycloak post we wired up a frontend SPA directly to a resource API. That works for two tiers — but most real architectures have three: a frontend, a BFF (Backend-for-Frontend) API,...
After the Klarna fraud I documented last week, I kept coming back to one question: how did someone pass Klarna’s identity check without ever logging in to my account? The answer is simple and unco...
On April 24, 2026, I received three emails in the span of a single minute that I never triggered. Two Klarna payment confirmations — €77.75 each — and a welcome email from ShopTo.Net: “You’re now a...
On April 17, 2026, I was standing at a checkout in a store when my card was declined. I knew I had enough money. I hadn’t spent anything significant in days. The decline made no sense. Back home, ...
When securing a modern web application that has a JavaScript frontend talking to a protected REST API, you need two distinct Keycloak client configurations. A common mistake is reusing one client f...
They say a picture is worth a thousand words, and nowhere is that more true than in software architecture and documentation. However, maintaining diagram files alongside code can be a hassle, espec...
The Security Upgrade & the Testing Headache Testing APIs secured with the PKCE flow using Robot Framework and libraries like REST or the RequestsLibrary can be quite challenging. PKCE, designe...
Detective Frost-eau continues to piece the evidence together, and Tracy McGreedy is now a suspect. What’s more, the detective believes that McGreedy communicated with an accomplice. Smartphones ar...
McSkidy is unable to authenticate to her server! It seems that McGreedy has struck again and changed the password! We know it’s him since Log McBlue confirmed in the logs that there were authentica...
As the elves try to recover the compromised servers, McSkidy’s SOC team identify abnormal activity and notice that a massive amount of data is being sent to an unknown server (already identified on...