Am I doing oAuth securely?

Question

OAuth

There is an authorization server auth.com, there are sites a.com and b.com that use it.
History:
- the client went to a.com
- clicked "Login"
- got to oAuth on the auth.com site
- logged in
- got back
- everything is fine
After that, as I understand it, he got cookies on the auth.com site, because if he enters on b.com, he will no longer need to enter a login / password, but we will identify him on auth.com by cookies ...
Conclusion: If the user's cookies are stolen (it doesn't matter how, at least copied from the browser) from auth.com, then the attackers get access to all connected sites (including a and b).
Question: How to minimize risks? How to make it so that after receiving the cookie there was no access to all services?

Answer 1

you can try to bind the session to IP, if cookies are stolen on another PC, they will no longer be relevant