Async trusted-device management and session security for FastAPI.
-
Updated
Oct 29, 2026 - Python
Async trusted-device management and session security for FastAPI.
Device Bound Session Credentials (W3C DBSC) for Django: stolen session cookies stop working.
Parse Set-Cookie flags — detect missing Secure, HttpOnly, SameSite and cookie security misconfigurations for AppSec reviews.
Login anomaly detection: impossible travel, fail bursts, and device churn (Python + TypeScript)
Security engineering laboratory for authentication, session protection, CSRF defense, token security, and automated security testing.
Zero Trust session monitor that scores live sessions against a behavioural baseline, binds requests to the browser with ECDSA signatures, and allows, step-ups or terminates sessions
Audits OAuth2/OIDC JWT configurations, token payloads, and HTTP Set-Cookie policies for alg: none bypasses, weak HMAC signing keys, missing exp/aud/iss claims, and absent HttpOnly, Secure, or SameSite flags.
To associate your repository with the session-security topic, visit your repo's landing page and select "manage topics."