https://blog.hardcodeconsulting.tech/tags/webcrypto/ Recent content in Webcrypto on Hardcode Consulting https://blog.hardcodeconsulting.tech/favicon.svg https://blog.hardcodeconsulting.tech/favicon.svg Hugo -- 0.167.0 en Sun, 02 Aug 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/signing-every-request-not-just-the-refresh/ Sun, 02 Aug 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/signing-every-request-not-just-the-refresh/ Device binding secured the token that rotates and left the one sent on every request a plain bearer secret. Closing that with a per request signature. https://blog.hardcodeconsulting.tech/post/binding-refresh-tokens-to-the-device/ Sun, 19 Jul 2026 18:00:00 +0530 https://blog.hardcodeconsulting.tech/post/binding-refresh-tokens-to-the-device/ A refresh token anybody can replay is a bearer secret. Binding it to a non-extractable WebCrypto key makes a copied token useless on its own.