Bearer Token
A security token that grants access to anyone who possesses it ('the bearer').
Detailed Explanation
Commonly used in the `Authorization: Bearer <token>` header, these tokens (often JWTs) are what you receive after logging in. Because they are self-contained and don't require a password for every request, they are the standard for modern API authentication. Their primary risk is 'token theft', if an attacker gets your bearer token, they are you.
Quick Summary
A bearer token is a credential that any holder can use , like cash. It's the dominant API auth pattern, but its security model is entirely about preventing theft and limiting damage when theft happens.
Key Takeaways
- Sent in the `Authorization: Bearer <token>` HTTP header by convention.
- Possession = authority , the server doesn't verify *who* holds it, only that the token is valid.
- Always use HTTPS; bearer tokens over HTTP are trivially sniffed.
- Keep them short-lived; pair with refresh tokens for long sessions.
- Storage matters: in-memory or httpOnly cookies beat localStorage, which is reachable by XSS.
When to use it
- Modern REST and GraphQL APIs as the default auth scheme.
- OAuth 2.0 access tokens used to call protected APIs.
- Service-to-service auth in microservices, with short TTLs.
- Mobile and SPA logins where cookies aren't always practical.
Common Mistakes
- Long-lived tokens (days or never-expire) , one leak gives the attacker indefinite access.
- Logging the Authorization header in access logs or error reports.
- Forgetting to revoke tokens on logout (especially JWTs, which are self-contained).
- Mixing tokens between environments , using a prod token in a debug request can leak it.
Bearer Token, Frequently Asked
JWT vs. opaque bearer token?
JWTs are self-contained and stateless (the server validates by signature). Opaque tokens are just IDs the server looks up in a token store. JWTs scale better; opaque tokens make revocation trivial. Many systems use JWTs with short TTLs to get both benefits.
How do I revoke a bearer token?
Opaque tokens: delete from the token store. JWTs: either keep TTLs short and rely on expiry, or maintain a revocation list / version stamp the server checks on each request. Self-contained tokens without a revocation path are a known footgun.