Author argues short-lived bearer tokens need proof of possession
The post argues that OIDC bearer tokens with 15-minute expiry do not prevent intrusions, and that proof of possession, such as TLS binding, is the only real solution. The author also predicts OIDC will end soon.
Source: Autor diz que tokens bearer de curta duração exigem proof of possession (x.com). Text prepared with AI from this source.
What happened and what to do
The author of the post contends that OIDC bearer tokens with 15-minute expiry do not prevent intrusions, because short lifetime alone does not stop token theft. He says the only real solution is proof of possession, such as binding the token to the TLS channel, and predicts that OIDC will be phased out soon.
In practice, a company issuing bearer tokens can start by mapping which APIs and clients accept tokens not bound to the sender, and how long those tokens stay valid after a possible theft. Options to evaluate include client-bound tokens, such as mTLS with certificates (RFC 8705) or DPoP (RFC 9449), combined with detection of token reuse in gateway logs. These controls depend on client-side and identity provider compatibility, which must be checked case by case.
How the consultancy can help
Diagnosis of how tokens are issued, validated and used between services, with a map of theft and replay exposure. Then design and implementation of sender-bound tokens and monitoring of anomalous use, operated continuously in the client's environment.
Next step
Send a short description of your authentication and API setup and receive a scoped proposal for diagnosis and implementation.
Let's assess your project
I reply with scope and a proposal.