Your access token was stolen. Now what: three layers of defence in your own OpenID provider

Description and use

Bearer tokens stored in the browser are easy to steal. By moving token storage to the server (BFF + Blazor Server), binding them to a DPoP key, and enabling fast revocation, token theft is prevented and token lifetimes are limited.

Problem

Bearer access tokens can be stolen from the browser and used by attackers for the token’s lifetime, exposing sensitive resources.

Outcome

By moving token handling to the server, using HttpOnly cookies, and binding tokens to keys, the system prevents token theft, limits token replay, and enables rapid revocation. The attack surface is significantly reduced, and detection of anomalous usage becomes more reliable.

Workflow

• 1. Replace SPA admin console with a BFF that performs OIDC exchange server‑to‑server.
• 2. Store access tokens in HttpOnly, Secure cookies and in the authentication ticket.
• 3. Use Blazor Server to render UI, eliminating client‑side JavaScript bundles.
• 4. Implement DPoP to bind tokens to a client key, making stolen tokens unusable.
• 5. Enable fast revocation to invalidate tokens immediately when suspicious activity is detected.

Evidence

Tokens are no longer exposed to the browser, reducing theft risk and limiting token lifetime.

Source