Bearer token
A token that grants access to whoever presents it, without proof of possession of a key (RFC 6750). A stolen bearer token works until it expires, so keep it short-lived and out of URLs and logs, and use sender-constrained tokens (DPoP or mTLS) for high-value APIs.
- Defined in
- RFC 6750
Covered in
Defend OAuth and OIDC against redirect and token attacks
Apply RFC 9700 and RFC 10017: exact redirect matching, PKCE with downgrade protection, state and iss binding, refresh-token rotation, sender-constrained tokens, and a backend-for-frontend so browser tokens cannot be stolen.
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Practice: CSRF lab: Protect an account change from a forged request · OAuth redirect and PKCE lab: Match redirect URIs and verify PKCE