🎫
Bearer Token
Session Management
Token presented as proof of authorization without additional binding; requires TLS and short lifetimes.
Definition
Bearer tokens grant access based on possession. Because they are not inherently bound to a device, strong protections are required: TLS, short expiry, audience restriction, and secure storage.
In plain English
Token presented as proof of authorization without additional binding; requires TLS and short lifetimes.
Why this matters
Why it matters: Token theft leads to immediate impersonation; limiting scope and lifetime reduces blast radius.
Example
Example: Use sender-constrained tokens when possible, and avoid storing bearer tokens in insecure browser storage.