Category
認証・認可（Cognito / OIDC / JWT）の実装ガイド
認証・認可は「クライアントを信じない」ことが出発点です。トークンは必ず署名と claims を検証し、認可はUIのif文ではなくサーバー／DBで強制する。Cognito・Auth0・Clerk・Supabase Authの選定軸から、JWT検証の落とし穴、カスタム認証フロー、エンタープライズSSO（SAML/OIDC）まで、本番で破綻しない設計を扱います。
9 articles in total
Foundational guide
Foundational guide (start here)
How to choose an authentication platform in 2026: an in-depth comparison of Cognito, Auth0, Clerk, and Supabase Auth, plus an implementation and migration guide
For decision-makers unsure about selecting an authentication platform, an in-depth comparison of Cognito, Auth0, Clerk, and Supabase Auth by evaluation axes. From B2B SSO (SAML/OIDC), MAU billing, data sovereignty, Next.js implementation, and JWT verification to user migration (lazy migration), explained with real-project design decisions.
Related practical articles
- JWTセキュリティPython認証・認可暗号
Why a JWT Signature Cannot Be Forged — Dissecting Verification Through Cryptographic Theory and PyJWT 2.13.0's Source
JWT signature verification explained from why it is safe, not how to call it. Measured avalanche effect in SHA-256 (a 1-bit flip changes 128.44 of 256 bits on average), why HMAC does not depend on collision resistance (Bellare 2006), and how PyJWT 2.13.0's api_jws.py, algorithms.py and jwks_client.py actually block alg:none and algorithm confusion — with real attack tokens thrown at the library.
31 min read - JWT認証・認可セキュリティTypeScriptアーキテクチャ設計
HS256 vs RS256, Settled by Spec and Measurement — Choosing a JWT Signing Algorithm, Rotating Keys, Migrating Without Downtime
Should you sign JWTs with HS256 or RS256? Grounded strictly in RFC 7518/8725, RFC 9068 and NIST SP 800-57/800-131A: the real difference (trust boundaries, not strength), the MUST-level key-size rules, algorithm confusion attacks that are still live in 2026, measured benchmarks for signing/verification/token size, a production-grade verifier in jose v6, key rotation, a zero-downtime HS256→RS256 migration, and regression tests.
40 min read - AWSCognito認証セキュリティPython
AWS Cognito Custom Authentication Flow Implementation Guide: OTP/Passwordless with the CUSTOM_AUTH Challenge, Store the PIN Safely with PBKDF2
An implementation guide for implementing OTP, passwordless, and LINE authentication with Cognito's CUSTOM_AUTH challenge (the Define/Create/Verify Lambda triggers), and storing a card PIN safely with PBKDF2-HMAC (high iterations, CSPRNG salt, constant-time comparison). Explained with real code, down to the post-confirmation hook and log masking.
25 min read - AWSCognitoJWTセキュリティPython
Correctly Verifying AWS Cognito's JWT (RS256): The Pitfalls of JWKS, kid, and token_use, and a Production Implementation
An implementation guide to correctly verifying AWS Cognito's JWT (RS256) in the backend. We explain — in real code (Python/TypeScript) — JWKS fetching and kid matching, RS256 signature verification, verification of iss/aud/exp/token_use, JWKS caching and periodic refresh, two-layer verification with the API Gateway authorizer, and pitfalls like alg=none and not verifying token_use.
21 min read - AWSCognitoSAMLOIDCSSO
AWS Cognito Enterprise SSO Guide 2026 | SAML/OIDC & Passwordless
Implement enterprise SSO (Azure AD/Okta/Google SAML·OIDC federation) and passwordless auth with AWS Cognito — 2026 edition. Feature plans, multi-tenant, JWT verification, SAML/OIDC attack defense, and build-vs-buy, with real code and official-docs citations.
29 min read - OAuth2OIDC認証JWTNext.js
ID Token vs. Access Token: The Complete Guide to Not Getting OIDC/OAuth2 Wrong in Implementation
ID tokens (OpenID Connect) and access tokens (OAuth2) differ in role, destination, and verification method. Conflate them and your API lets authorization slip through — a serious vulnerability. Understand the difference from first principles via 'whom is it addressed to (audience),' and learn the real Authorization Code + PKCE flow, JWT verification with jose, and token storage in a BFF, with production-grade real code.
23 min read - 認証基盤OIDCNext.jsTypeScriptアーキテクチャ設計
Building your own auth hub that bundles multiple AI tools: BFF × OIDC × back-channel logout (PKCE required, PII encryption, audit logs)
Dissecting the auth hub (BFF) of an internal platform that bundles multiple AI tools of differing nature into a single SSO, with real code as the single source of truth. At the implementation level it explains a homemade OIDC provider, short-lived JWTs narrowed to a per-tool audience, mandatory PKCE S256, auto-POST that doesn't put tokens in the URL, HMAC-signed back-channel logout, and PII encryption with AES-256-GCM and audit logs.
13 min read - AWS CognitoTerraform認証設計B2B SaaSセキュリティ
Complex Authentication / Authorization Design Realized with AWS Cognito + Terraform: An Enterprise-SaaS Practice Managing 8 Kinds of User Attributes
Explains how to realize the complex per-user-attribute authentication / authorization essential to B2B SaaS with AWS Cognito. Publishes practical design patterns: 8 kinds of user attributes, page-level / API-level access control, pre-signed URLs, and full automation with Terraform IaC.
9 min read