WHAT OKTA BCRYPT INCIDENT CAN TEACH US ABOUT DESIGNING BETTER APIS

Summary from the TLDR Web Dev newsletter

The Okta Bcrypt incident exposed a vulnerability where excessively long usernames allowed authentication bypass due to the 72-character input limit of the Bcrypt algorithm, leading to ignored password data. Through testing various implementations in Go, Java, JavaScript, and Python, the blog post shows that while some libraries enforce this limitation correctly (like Go's and Patrick Favre's Java Bcrypt), others fail to do so (such as Spring Security and bcryptjs).