https://nalar.dev/tags/token-security/ Recent content in Token Security on Nalar Hugo en-us Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/treat-signed-urls-as-bearer-capabilities/ Mon, 07 Sep 2026 00:00:00 +0700 https://nalar.dev/treat-signed-urls-as-bearer-capabilities/ <p>A signed URL can make private content easy to share. Instead of requiring the recipient to authenticate to the storage service, an application creates a URL containing enough authorization information for the service to accept a specific request.</p> <p>That convenience changes the security model. Anyone who obtains a usable copy of the URL may be able to exercise the authority it carries. If the URL permits too much, remains valid too long, or is exposed through logs and messages, a small disclosure can become unintended access.</p>