•5 min read
Authentication is not authorization: three security stories from one quarter
A planned Google OAuth feature, the March 31 axios npm compromise, and a latent WebSocket subscribe hole — three different shapes, one rule: authorize at every join.