Bearer Token Security

A bearer token grants its associated access to whoever presents a valid copy, so it must be treated as a secret. Send it over HTTPS, validate it and its permissions, and minimize exposure through careful storage, logging, lifetime, and revocation practices.

A bearer token is a secret credential presented with a request, commonly in the HTTP `Authorization: Bearer <token>` header. The server grants the associated permissions to whoever presents a valid token; the token itself does not prove the presenter’s identity.

Because possession is enough, anyone who steals the token may be able to use it until it expires or is revoked. Send tokens only over HTTPS, and avoid putting them in URLs, where they can leak through logs, browser history, analytics, or referrer data.

Servers should validate tokens and their intended scope, audience, and lifetime according to the token format and authentication system. Use short lifetimes where practical, limit permissions, and provide a rotation or revocation strategy appropriate to the system.

Clients and services should keep tokens out of source control, error messages, and logs. Store them with appropriate access controls, and redact the `Authorization` header in observability pipelines. HTTPS protects data in transit; it does not prevent theft from a compromised client or server.

Key points

• Treat possession of a valid bearer token as sufficient to use its granted permissions.
• Send bearer credentials in the `Authorization` header over HTTPS, not in URLs.
• Validate token integrity, validity period, intended audience, and permissions as applicable.
• Use least privilege, limited lifetimes, and a practical rotation or revocation plan.
• Never expose tokens in source code, logs, error responses, or telemetry.

Interview questions

What is a bearer token?

A bearer token is a credential whose possession is sufficient to present it for access. The server validates the token and then applies authorization rules to determine what the request may do. It is commonly sent in the `Authorization` header using the `Bearer` scheme. Since the token does not prove who is holding it, preventing disclosure is essential.

How should a client send a bearer token to an API?

The client sends it in the HTTP `Authorization` header, for example `Authorization: Bearer abc...`, and only over HTTPS. Putting a token in a query parameter is risky because URLs are often retained in logs, browser history, and other systems. The service should also ensure that proxies and telemetry do not record the credential-bearing header.

If an API uses HTTPS, why is bearer-token handling still important?

HTTPS encrypts traffic between the TLS endpoints, protecting the token from straightforward interception on the network. It does not stop a compromised client, server, browser extension, or logging pipeline from exposing the credential. It also does not make a leaked token safe to reuse. Treat endpoint security, storage, and logging as separate parts of the threat model.

What checks should a backend perform before accepting a bearer token?

Validate the token using the mechanism appropriate to its format, then check required claims or attributes such as expiry, issuer, audience, and scopes when applicable. Authentication establishes that the credential is acceptable; authorization checks whether it permits this operation on this resource. Reject malformed, expired, or inappropriate tokens and return an appropriate error without revealing the token or sensitive validation details. Do not assume that decoding a token is equivalent to validating it.

How would you reduce the impact of a bearer token compromise?

Use short-lived tokens and narrow scopes to limit the value and duration of a stolen credential. Provide a way to revoke or rotate credentials when compromise is suspected, and keep secrets out of source control and logs. Monitor access and apply rate limits or other abuse controls where appropriate. The exact design depends on token format and the service’s operational requirements; expiration alone does not instantly invalidate a token before its expiry.