Token Security

Cybersecurity 19 Sep 2026 6 min read

DPoP Binds OAuth Tokens to Client Keys, Not to Client Identity

A bearer access token normally authorizes whichever party can present its value to a resource server. Copying the token can therefore move its authority away from the client that originally received it. OAuth 2.0 Demonstrating Proof of Possession, or DPoP, changes that property by binding a token to a public key and requiring a signed proof from the corresponding private key during presentation. That binding narrows one important failure mode, but it does not turn the key into a universal client identity. DPoP is an application-layer sender-constraining mechanism. Its guarantees depend on the token binding, proof validation, replay policy, TLS, and the security of the client execution context.

Cybersecurity OAuth

Cybersecurity 11 Sep 2026 9 min read

Keep Bearer Tokens Out of URLs

A bearer token grants access to whoever presents it successfully. That makes its storage and transport path part of the authentication design. If an application places such a token in a URL, the credential can travel into systems that were built to record or process URLs rather than protect secrets. The immediate request may still use HTTPS. The problem is what happens around that request: server access logs, reverse proxies, monitoring tools, browser history, support captures, and analytics pipelines can all handle URL data. A token copied into those places gains more exposure paths and can remain there long after the request finishes.

Cybersecurity Authentication

Cybersecurity 07 Sep 2026 10 min read

Treat Signed URLs as Bearer Capabilities

A signed URL can make private content easy to share. Instead of requiring the recipient to authenticate to the storage service, an application creates a URL containing enough authorization information for the service to accept a specific request. That convenience changes the security model. Anyone who obtains a usable copy of the URL may be able to exercise the authority it carries. If the URL permits too much, remains valid too long, or is exposed through logs and messages, a small disclosure can become unintended access.

Cybersecurity Access Control