Honestly I’m not convinced it is a solved problem. I have been trying to get my head around OAuth, zero trust, Fido, SAML et al - and I am not sure I get it.

Honestly I’m not convinced it is a solved problem. I have been trying to get my head around OAuth, zero trust, Fido, SAML et al - and I am not sure I get it. It’s not that say “JWT tokens might be dangerous” it’s how to hang it all together in a sane manner. For example I was listening to Security Cryptography Whatever podcast and one of the guests (Chrome dev?) said obviously don’t trust everything that comes down an established TLS connection but verify / auth each request. That’s a pretty tall order and seems to nullify quite a lot of established frameworks But realistically I think a lot of frameworks and standards serve different needs than “smallish number high value clients”