redb.Identity Deploys Three-Layer Defense to Neutralize Stolen Access Tokens in OpenID Connect
redb.Identity, a custom OAuth 2.1 / OpenID Connect provider developed on .NET, tackles the problem of stolen access tokens with three concrete layers of defense rather than relying on declarative statements. Bearer tokens work for whoever possesses them, allowing an attacker who extracts a token via XSS, a compromised npm package, browser extension, or localStorage to operate from any machine until expiration, typically fifteen minutes to one hour.
Origin of Token Theft
Token theft commonly stems from XSS in the application itself, XSS through a dependency where a compromised npm package gains the same DOM and network access as first-party code, malicious browser extensions, or direct reads from localStorage. All four vectors allow the attacker to carry away the token itself, eliminating any need for the victim’s browser, network, or session.
Layer One: Preventing Theft with BFF
Most identity-server admin consoles, including Keycloak and WSO2 Identity Server, run as public OAuth clients in the browser and therefore store administrator access tokens in JavaScript-accessible memory. redb.Identity.Web instead uses Blazor Server with cookie authentication. Tokens are stored on the authentication ticket via AuthenticationTokenExtensions.StoreTokens and retrieved server-side with GetTokenAsync. All intermediate states such as MFA challenges and consent screens are likewise held in HttpOnly, SameSite=Lax, Secure cookies protected by Data Protection. Because markup renders on the server and only a SignalR diff reaches the browser, no JavaScript bundle holds application state.
BFF converts a silent compromise from another country into an active session inside the victim’s browser only while the page remains open. It therefore trades one detection signal (impossible travel) for a smaller blast radius, but still requires behavioral monitoring.
Layer Two: Rendering Stolen Tokens Useless with DPoP
DPoP (RFC 9449) binds tokens to a private key generated inside the client. At issuance the server records the key thumbprint in the cnf.jkt claim. Every subsequent request must include a fresh, signed proof JWT tied to the exact HTTP method and URL. A token stolen without its private key is rejected because the server demands a valid proof. The implementation includes stateless HMAC nonces, a jti replay cache per key, and an allow-list of asymmetric algorithms only. A separate package, redb.Identity.Resource.Dpop, lets resource APIs perform the same validation.
Layer Three: Rapid Revocation
Even strong binding requires fast revocation when a user departs, a device is lost, or an incident is confirmed. redb.Identity supports RFC 7009 token revocation, refresh-token rotation, idle-timeout sessions updated on real activity, and backchannel logout in both push and pull modes. The pull feed of revoked session identifiers allows any recovering replica to query “/revoked-sids/since?cursor=…” and catch up without missing events. BFF validation itself checks this list on every cookie request so that a global sign-out immediately terminates live sessions across all replicas.
Supporting Controls
Password history, TOTP step locking to prevent replay within the acceptance window, server-side hashed one-time codes for SMS and email, atomic recovery-code consumption, constant-time comparisons via CryptographicOperations.FixedTimeEquals, and three-tier rate limiting (IP, client_id token bucket, and IP-plus-user) are all implemented. Proxy headers are sanitized before reaching rate limiters or block counters, and idempotency caches sit after authorization checks.
Related articles
OpenAI Releases GPT-6.1 Terra: Cost-Effective Model Focused on Computer Control, Image Analysis and Practical Automation
OpenAI has launched GPT-6.1 Terra, a new model positioned between its high-end GPT-6 Astra and more affordable options in the GPT-6 family. The model emphasizes real-world computer interaction, visual understanding of documents and interfaces, and reduced error rates rather than raw reasoning benchmarks. It supports a 1.05 million token context window, image inputs, and tool use through the Responses API while cutting input token prices by half compared with its predecessor. Published benchmarks show substantial gains on Terminal-Bench 4.0, OSWorld 2.1 and Agents' Last Exam, with error rates dropping sharply at both low and maximum reasoning levels. OpenAI stresses that the model still requires human oversight for high-stakes actions and does not directly process audio or video. The release targets developers and enterprises seeking reliable automation of repetitive multi-step tasks at lower cost than flagship models.
Yandex Black October: How Architectural Flaws and Capacity Mismanagement Turned Data Center Losses Into a 11-Day Fintech Coma
In October 2026 three Yandex data centers in Central Russia were physically destroyed within days, triggering the collapse of Yandex Cloud and multiple core services. Between the first and third site failures engineers had 74 hours to restore quorum and rebalance workloads yet failed to do so because Control Plane components remained tied to the lost zone and spare capacity had been eliminated to cut costs. Core banking and BNPL systems entered Read-Only mode after losing quorum, forcing a complete stop-the-world reconciliation that lasted until 22 October. Backups stored inside the same regional S3 buckets proved unusable, resulting in a seven-day RPO and primary-key collisions after restoration. The incident exposed that Metro-Cluster designs had been incorrectly treated as full Disaster Recovery and that aggressive AP microservice patterns created logical split-brain conditions outside the database layer.
Astra Group Releases Low-Code Astra AI Platform for Building Corporate AI Agents in Closed Environments
Astra Group has launched the Astra AI Platform, a low-code constructor designed for creating corporate AI applications that operate entirely within closed circuits without reliance on foreign clouds. The platform targets small and medium businesses as well as large corporations, enabling rapid deployment of AI secretaries, technical support assistants, and other agents in days rather than months. It forms part of the broader Astra AI ecosystem and includes two main constructors: one for machine learning model training and deployment, and another for LLM-based language assistants, document search, and process automation. Users can assemble scenarios from visual blocks, debug them in real time, or extend functionality with custom Python code when needed. The solution supports RAG-based knowledge bases, integration with external tools such as CRM and ERP systems, and the coordination of multiple agents for distributed task handling. One demonstrated use case involves processing ten pages of engineering drawings and specifications in five minutes to prepare data for downstream systems. The product is already listed in the Russian domestic software registry and available to customers.
Multi-Tenancy Isolation in VictoriaMetrics, VictoriaLogs and Grafana: Building Client Separation in a Shared Stack
Voltir runs a single shared monitoring stack consisting of VictoriaMetrics, VictoriaLogs, Grafana and vmalert for all customers instead of deploying separate instances per tenant. Isolation relies on numeric account IDs enforced at every layer: nginx validates tokens against the platform API before proxying writes, Grafana data sources hard-code tenant accounts, and vmalert rules receive automatic account filters. The team discovered that a single malformed rule or template could break alerting for every tenant because vmalert loads the entire rules directory at once. They also found that Grafana automatically created personal organizations granting Org Admin rights, accumulating hundreds of orphaned organizations and users that consumed disk space and resources. A dedicated cleanup module plus hourly reconciliation now removes rules, organizations, series and users when a tenant is deleted, while isolation tests verify both data and API objects across tenants.