Post #1679484

How do you 'hide' the actual OIDC Access Token from a user when you have no database? - create a random 32 byte passphrase - synchronously encrypt access token with passphrase - asynchronously encrypt passphrase with a 2048 bit public key - (optional) sign encrypted passphrase with private key - set encrypted passphrase, encrypted token and signature as cookies On the next access, do it in reverse. Invalidate all sessions? Create new keypair. Prevent brute-force? Token lifetime.