The developer stories enterprise IT leaders actually read.
Volume 342, Issue 1 · 9 articles from 3 issues
A practical guide to implementing enterprise single sign-on in Next.js apps supporting both SAML and OIDC identity providers.
The guide explains how to integrate enterprise SSO into Next.js applications without handling raw SAML protocols directly.
SSOJet acts as a protocol broker between customer identity providers and the application, normalizing SAML and OIDC into a single OIDC interface.
Two implementation paths are presented: NextAuth.js for faster deployment with built-in session management, or oidc-client-ts for teams needing granular control over authentication flows.
Both approaches support major providers including Okta, Microsoft Entra ID and Google Workspace. The article also covers security best practices and troubleshooting for production deployments.
AI-assisted development improves code quality when paired with governance and engineering discipline; weak process is the real problem.
Paul Done, Field CTO at MongoDB, distinguishes problematic "vibe coding" - rapid AI-generated code shipped without review - from legitimate AI-driven development that accelerates workflows.
He argues concerns about low-quality output stem from weak processes rather than from AI itself, and that organizations with strong engineering practices will see AI amplify their existing standards.
As velocity increases, the industry must shift from manual code review toward AI-enforced standards while humans concentrate on architecture and oversight. Combined with governance, continuous testing and security discipline, AI can raise baseline code quality and help address technical debt.
Software Engineers' New Job Isn't Writing Code - It's Designing the Boundaries AI Agents Can't Break
AI agents are rapidly taking over routine coding tasks, forcing software engineers to shift from implementation toward architectural governance. Using thermodynamic and physics metaphors, the article argues that engineers must now design containment fields such as semantic data contracts, immutable logs, and deterministic APIs to create bounded domains where agents can work reliably.
Without clear boundaries and feedback mechanisms, agent-generated code accumulates errors through what the author calls operational entropy.
The real value of software engineering emerges in designing the conditions where generated code succeeds rather than fails, transforming the profession from code authorship to equilibrium design.
Verbose JSON makes agents pay for field names hundreds of times; tool output format is an engineering decision.
Most of what teams pay for in agentic coding is not the pull request but everything the agent read to produce it, and a often-overlooked lever is the format in which developer tools hand data back.
When a tool returns a long list of similarly shaped records, verbose JSON charges the model repeatedly for field names, quotes, and structural syntax.
The article is careful not to condemn JSON, which remains widely supported and more compact for nested or irregular data; the narrow question is what to do with large uniform collections.
Token-Oriented Object Notation (TOON) is offered as one answer, keeping a schema-like header for a uniform array and emitting each record as a row - a lossless encoding of the JSON data model that also gives the model a predictable field set.
Airbnb moved auth decisions from clients to a server policy engine, cutting code 60% and speeding experiments to days.
Airbnb rebuilt its authentication flows around a server-driven architecture in which a backend policy engine, not the client, decides which challenge a user sees.
Reported results include a 60% reduction in authentication code, a 100 KB smaller web bundle, 2.6% more successful authentications, 27% fewer duplicate accounts, and roughly 11% lower OTP costs.
Because strategy lives on the server, Airbnb ran more than 20 experiments in three months and can vary flows by region, such as preferring WhatsApp OTP in Brazil.
New agent identity standards prove who an agent claims to be but not whether its behavior has silently changed.
Four agent identity standards have reached production - Microsoft's Entra Agent ID, the Linux Foundation's Agent Name Service, DNS-AID, and Cisco's AGNTCY - but the article argues they only address naming and identity verification.
A valid identity proves very little if the agent can change its behavior without anyone noticing, since none of these schemes detects a swapped underlying model, altered system prompt, or shifted operational context. The unresolved gap is runtime integrity and behavioral accountability.
The author also contends that automatically expiring agent credentials matters more than revocation machinery, because attackers move faster than human review processes.
Forward-deployed engineering only pays off if field learnings compound into product, not one-off services labor.
Forward-deployed engineering has become a common operating model for enterprise AI, but Neej Gore argues its value depends entirely on whether it produces reusable product capability or just custom services work.
Effective FDE acts as a context layer, capturing business rules, workflows, and operational logic and converting them into scalable product features.
The test is whether the next deployment starts with fewer unknowns and less custom code than the last.
He recommends tracking engineering hours per deployment and productization lag as indicators of whether the work compounds. Otherwise field discoveries accumulate as services labor rather than durable advantage.
Rust 1.98 stabilizes algebraic float methods and buffered integer formatting for better compiler optimizations.
Paul Krill reports that Rust 1.98.0 introduces algebraic methods for f32/f64 floating-point operations-algebraic_add, algebraic_sub, algebraic_mul, algebraic_div, and algebraic_rem-that let the compiler reorder operations like a+b+c+d into partial sums evaluated simultaneously using real-number properties.
The release also stabilizes a format_into method for buffered integer formatting that bypasses dynamic-dispatch overhead for a performance boost. Additional stabilized APIs cover substring range utilities, UTF-16 encoding methods, and atomic operations, continuing Rust's steady expansion of its standard library.
CISA finds the most-exploited vulnerability classes are decades old and entirely preventable.
CISA's latest review found that most exploited vulnerabilities belong to well-known, decades-old classes: injection attacks, improper input validation, and path traversal.
The agency blames organizational culture and weak adoption of Secure by Design practices rather than technical difficulty for their persistence. Seven of the top 10 common weakness types in 2024 were classified as stubborn by MITRE, three of them predating modern security awareness by nearly two decades.
CISA's message to vendors is to build software securely from the start rather than shipping ever-larger patch bundles.
More from Developer · All IT section newsletters · This week