https://nalar.dev/tags/bearer-tokens/ Recent content in Bearer Tokens on Nalar Hugo en-us Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/limit-bearer-token-damage-with-scope-and-lifetime/ Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/limit-bearer-token-damage-with-scope-and-lifetime/ <p>Bearer tokens are convenient because a service can accept a request based on a credential presented with it. That convenience creates a simple security problem: if an attacker obtains a usable bearer token, the attacker may be able to present it too. The receiving service usually cannot distinguish the legitimate holder from a thief merely by possession of the token.</p> <p>The defensive goal is therefore not only to keep tokens confidential. It is also to limit what a stolen token can authorize and how long that authority remains useful. A token that can perform one narrow task for a short period creates a smaller exposure than a long-lived token with broad access.</p>