Working on the devlog-ist/landing project, we're refining the authentication flow. The goal is to streamline user registration and login, particularly for non-developers who might be contributing recommendations. We've adjusted the available OAuth providers to match user roles.

Previously, both GitHub and LinkedIn were presented as default options on the login and registration pages.

OAuth provides a streamlined approach to user authentication, but it's crucial to implement security measures that protect user data and prevent unauthorized access. A common scenario involves social login, where users authenticate via third-party providers like GitHub or LinkedIn.

The Problem: Unregistered Users and Automatic Registration

A potential vulnerability arises when users not yet

Introduction

This article discusses a common issue in applications using GitHub OAuth for authentication: inadvertently overwriting a user's existing token with one that has fewer permissions. We'll explore how to ensure the application preserves the user's original, broader-scoped token when requesting narrower scopes during subsequent logins.

The Problem

Many applications use GitHub

Providing users with options to personalize their experience can significantly improve satisfaction. A recent enhancement to our application allows users to select their preferred font from a curated list, offering a more tailored and visually appealing interface.

The Power of Personalization

Customization empowers users, making them feel more in control and connected to the application.

This post details a recent effort to improve the security, reliability, and maintainability of our application. It covers several key areas, including XSS prevention, reCAPTCHA consolidation, OAuth error handling, dependency injection, and code cleanup.

Securing web applications requires a multi-layered approach. Recent updates to our application focused on bolstering security through rate limiting on authentication routes and implementing granular access control for administrative resources.

Rate Limiting Authentication Routes

To mitigate brute-force attacks and other forms of abuse, we've implemented rate limiting on critical

Overview

This update focuses on refining access control for AI settings and improving the Post Generator navigation within the application. Key changes include restricting access to AI configuration settings to superadmin users only and reordering the Post Generator in the navigation menu for improved user experience.

AI Settings Access Control

To enhance security and prevent