Security
Token theft and replay: how bearer tokens are stolen and how to limit the damage
Where access and refresh tokens leak from, why bearer tokens are replayable by design, and the layered defences: short lifetimes, rotation, sender-constraining.
The short answer
A bearer token works for whoever holds it (RFC 6750), so a stolen token can be replayed from anywhere until it expires. Defences are layered: keep tokens out of URLs and logs, keep access tokens short-lived, rotate refresh tokens with reuse detection, revoke on sign-out, and sender-constrain tokens with DPoP or mutual TLS so a copied token is useless without the client's private key.
Sources last reviewed .
Where tokens leak
- Browser storage reachable by injected script (XSS).
- URLs — query strings and fragments end up in history, logs and referrers.
- Application and proxy logs that record Authorization headers.
- Compromised developer machines and CI systems holding long-lived credentials.
- Over-broad token audiences, so a token for one service works at another.
Defences in order of effort
- Never put tokens in URLs; redact Authorization headers in logs.
- Short access token lifetimes and narrow audiences (RFC 8707 resource indicators).
- Refresh token rotation with reuse detection, and revocation (RFC 7009) on sign-out.
- A backend-for-frontend so browser code never holds tokens.
- Sender-constrained tokens — DPoP (RFC 9449) or mTLS (RFC 8705).
In Authreads
How this applies to Authreads
Refresh token rotation with family revocation, a revocation endpoint and DPoP sender-constrained tokens for machine and agent identity are Available.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Sources
- RFC 6750 — Bearer Token Usage
- RFC 9700 — Best Current Practice for OAuth 2.0 Security
- RFC 9449 — OAuth 2.0 Demonstrating Proof of Possession (DPoP)
- RFC 8705 — OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
- RFC 7009 — OAuth 2.0 Token Revocation
- RFC 8707 — Resource Indicators for OAuth 2.0
Keep reading
Protocols and how-tos
DPoP implementation guide: sender-constrained tokens without mTLS
Protocols and how-tos
Refresh token rotation and reuse detection, explained
Protocols and how-tos
OAuth and OpenID Connect for single-page apps: where tokens should live
Glossary: Access token · Refresh token · DPoP · Bearer token
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.