SecureCodeReviews
Category Hub

Identity & Access Security Guides

Use this hub to navigate SecureCodeReviews coverage on identity & access, common failure modes, and fixes that matter in production systems.

Authentication
FIDO2
MFA
Passkeys
Phishing
WebAuthn
Zero Trust

Articles

1

Latest Update

January 29, 2026

Top Tags

7

Related Topic Hubs

Higher-intent paths built around specific security questions.

OAuth and Modern Auth Security Hub

Guides on OAuth 2.0, PKCE, redirect URI validation, JWT vs sessions, and delegated access design decisions.

Identity & Access

Phishing-Resistant MFA: Passkeys, WebAuthn & the End of Passwords in 2026

Traditional MFA is defeated by real-time phishing proxies like Evilginx2. This guide covers phishing-resistant authentication — FIDO2/WebAuthn, passkeys, hardware keys, and why SMS OTP is no longer acceptable.

Jan 29, 2026
19 min read
Read article

Need this category reviewed in your own stack?

The articles here are a good starting point. If you need a targeted review for a release, feature, or audit scope, we can assess the concrete implementation rather than the generic pattern.