Radar ·
Author argues short-lived bearer tokens require proof of possession
An author argues that 15-minute bearer OIDC tokens do not prevent intrusions and that binding tokens to the sender, such as via TLS, would be the effective fix.
According to the briefing published on October 22, 2026, the author argues that bearer OIDC tokens with a 15-minute expiry do not prevent intrusions. In his view, short duration alone does not stop token theft, and proof of possession, such as binding the token to TLS, is the only real solution. The text also predicts that OIDC will end soon, a prediction the material does not support with data.
The central recommendation is to consider sender-constrained tokens. The material is a short note and does not describe tests, metrics or implementations. To verify the claims, consult the original source, identify the authorship and assess the technical details before adopting any change. This content does not describe any Rota Nacional capability.
Original source: Autor diz que tokens bearer de curta duração exigem proof of possession