Bearer Tokens

Limit Bearer Token Damage with Scope and Lifetime

Bearer tokens are convenient because a service can accept a request based on a credential presented with it. That convenience creates a simple security problem: if an attacker obtains a usable bearer token, the attacker may be able to present it too. The receiving service usually cannot distinguish the legitimate holder from a thief merely by possession of the token. The defensive goal is therefore not only to keep tokens confidential. It is also to limit what a stolen token can authorize and how long that authority remains useful. A token that can perform one narrow task for a short period creates a smaller exposure than a long-lived token with broad access.