generic-oidc-offline-token-policy

Apply an OIDC offline token policy to restrict scopes to openid and profile, removing offline_access. This enforces session-bound authentication and prevents long-lived credential exposure in local or demo environments.

Session-bound OIDC authentication restricts token lifetimes to active sessions. Avoiding offline tokens prevents long-lived credential exposure, ensuring compliance with the principle of least privilege in local development environments.

This OIDC offline token policy applies to local development and demo environments using OIDC providers like Keycloak. It enforces standard OIDC scope restrictions and validation for any compatible OIDC provider.

Restrict OIDC scopes by applying a scope hardening policy that limits scopes to essential requirements like openid and profile. This ensures demo users do not inherit long-lived offline tokens that expand the security blast radius.

Required OIDC security validations include strict validation of issuer, nonce, and redirect URI integrity. These validations maintain secure authentication patterns during local development alongside scope hardening.

Avoid offline tokens in local OIDC development when demo users could expand the security blast radius with long-lived credentials. Enforce session-bound authentication instead to maintain the principle of least privilege.