CryptoKey with IndexedDB to secure stateless authentication

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible.

I'm considering a scenario where the issued JWT is bound to some asymmetric key pair. It could look as below:

1. Asymmetric key pair (CryptoKey) is stored in browser in IndexedDb.
2. User sends login request with hash of generated public key.
3. Issued access token has claim 'proof_of_possession_hash'.
4. Every request to resource server from browser to be authorized must use Authorization header with access token and PoP header which is JWT signed by CryptoKey (with very short lifetime, needed to complete ONE request)

The PoP token will contain claims: iss (access token owner), aud (resource server), method (HTTP method which will be used at resource server), jti (so resource server can occasionally revoke PoP)

I'm considering whether it has some issues, or whether is has advantages (security advantages) over just session cookies.

What firstly comes to my mind is that cookies are probably sent with every request and they are vulnerable to some web attacks. And when they leak, attacker has full access.

I will use local storage to store access tokens, and IndexedDB to store CryptoKey. If the private key cannot be exported, is there any way to get unauthorized access to user account, except situation where attacker can access data stored at user disk?