A Practical Guide to Building Secure SSO
Understanding how to build Single Sign On (SSO) using the OAuth 2.0 framework with OpenID Connect may seem like a daunting task. This practical guide will show you how to build a secure SSO system.…
Nonce-based Content Security Policy (CSP) in Rails
Introduction During my time at Gusto as a part of the Application Security team, I’ve been exploring ways to improve defense against Cross-Site Scripting (XSS) in modern web applications. At Gusto, we primarily use Ruby on Rails and React.js. Individually each framework comes with some XSS protections out…
Layering authorization into a web application
How we introduced granular authorization into our application and API. Illustration by Camellia Neri Last year, my team extended Gusto’s authorization system to give admins granular access to their companies’ accounts. In software security terms, authorization is the concept of what a user can do in a system, while…
An Open Email about Diversity
Updates from Gusto about their latest engineering diversity numbers.…
When Girls Lose Interest in Stem — and What You Can Do about It
Patches our design team created for the event I'm an engineer at Gusto. In my spare time, I teach middle- and high school-aged girls how to code. I do this because I want girls to know about all the career options that are available, even if their communities don’t.…