Bearer Token.

A bearer token is a credential whose use is authenticated by possession alone: anyone who can present the token at the API gains the access it represents. It is most commonly carried in an HTTP Authorization: Bearer header and is defined by RFC 6750 in the context of OAuth 2.0. Because there is no proof-of-possession, bearer tokens must be transported over TLS, stored carefully, scoped narrowly, and given short lifetimes. Leaked bearer tokens are immediately abusable until revoked or expired.

Why possession-only credentials keep failing

Two landmark 2023 incidents show the risk. In the Okta support-system breach (initial access around 28 September 2023), attackers read customer-uploaded HTTP Archive (HAR) files that still contained live session cookies and tokens, then replayed them to pivot into customers such as BeyondTrust (2 October) and Cloudflare (18 October). Separately, the Storm-0558 campaign forged Azure AD/MSA bearer tokens with a stolen Microsoft signing key, silently accessing Exchange Online mailboxes at roughly 25 organizations, including the U.S. State and Commerce Departments. In both cases the token worked because it was valid — the whole weakness of bearer semantics.

Stronger designs make a stolen token useless. Sender-constrained (proof-of-possession) tokens bind the credential to a key the client must prove it holds on every call: DPoP (RFC 9449) at the application layer via a signed JWT header, and certificate-bound mTLS tokens (RFC 8705) at the transport layer via cnf.x5t#S256. Both are mandated by the FAPI 2.0 profile. Complementary defences include short TTLs with refresh rotation, audience/scope restriction, token binding to device or IP context, and prompt revocation on anomaly.

flowchart TD
  C[Client] -->|Authorization: Bearer token| API[Resource server]
  API -->|token valid?| API
  API -->|yes| G[Grant access]
  L[Attacker steals token] -->|replays same token| API
  API -.no possession proof.-> G
  subgraph Mitigation
    D["DPoP / mTLS binds token to client key"] --> R[Stolen token rejected]
  end