Blog

• The load balancer that drops session cookies

  How a session cookie disappears once TLS terminates at a load balancer: the application saw the wrong scheme, a proxy rewrote Set-Cookie, or the next node has no session for an id that arrived intact.

• Rollback day: practicing the auth cutover you hope you never need

  A real auth rollback is a controlled reverse of a live cohort, not a runbook paragraph. Rehearse state, order of operations, and recovery messaging before the cutover you hope never needs reversing.

• MFA fatigue is not a security strategy

  High MFA enrollment with constant push prompts is notification noise, not a control. Measure challenge volume, cut silent reauth, and prefer factors that do not train approve-by-habit.

• Passwordless rollouts: what breaks first in production

  The delivery, device, and recovery failures that show up in the first week of a passwordless login rollout, and how to stage the cutover around them.

• Sessions versus JWTs when you actually have to migrate later

  How your browser session model decides the pain of the next auth cutover, with the concrete JWT and opaque-session taxes that show up in production.

• What LLM ops taught us about staged rollouts

  A guest post from the LLMOp team on the rollout patterns LLM work has produced, and what auth teams running migrations can take from them.

• How to scope an auth migration without surprises

  A working framework for engineering leads about to scope an auth migration, covering the parts that get missed in plans drafted by people who have not done one before.

• When to migrate off Auth0 (and when to stay)

  A practitioner view of the signals that mean your Auth0, Cognito, or Okta bill is no longer the cheapest decision, and the cases where staying is still right.