TesseraApp
Full-stack CIAM platform on a hybrid zero-trust model: stateless HMAC-SHA512 JWTs backed by a revocable refresh-session store, in-house RFC-6238 TOTP MFA, and OAuth2/OIDC federation across Google, GitHub and Microsoft over org-scoped RBAC.
Case study
Problem
TesseraApp needed sessions that were both fast to verify and instantly revocable, MFA that didn't depend on a third party, and federated login that stayed safe under org-scoped access control.
Approach
Stateless HMAC-SHA512 JWTs are backed by a stateful refresh-session store for instant revocation and family-wide reuse detection; in-house RFC-6238 TOTP MFA and OAuth2/OIDC federation across Google, GitHub and Microsoft sit behind permission-based RBAC, hardened with BCrypt-12 hashing, brute-force lockout and enumeration-safe login.
Outcome
Live in production, shipped through multi-stage Docker and GitHub Actions with device/IP audit logging across every session.
What it does
Hybrid zero-trust sessions
Stateless HMAC-SHA512 JWTs backed by a stateful refresh-session store, enabling instant revocation, "log out everywhere," and refresh-token rotation with family-wide reuse detection.In-house MFA and federation
RFC-6238 TOTP with authenticator QR enrollment and hashed recovery codes; OAuth2/OIDC federation across Google, GitHub and Microsoft over org-scoped, permission-based RBAC.Hardened by default
BCrypt-12 hashing, brute-force lockout, enumeration-safe login and device/IP audit logging, shipped through multi-stage Docker and GitHub Actions.
