Bearer tokens are the cash of the digital world. They need to be protected. Whoever gets hold of them, can well, basically use them as if they were you. Pretty much the same as cash. The shop owner only really checks the cash is real, they don't check that the £5 note you produced from your wallet is actually your £5 note. This has been an age old issue in web access management technologies, both for stateless and stateful token types, OAuth2 access and refresh tokens, as well as OpenID Connect id tokens. In the hyper connected Consumer Identity & Access Management (CIAM) and Internet (Identity) of Things worlds, this can become a big problem. Token misuse, perhaps via MITM (man in the middle) attacks, or even resource server misconfiguration, could result in considerable data compromise. However, there are some newer standards that look to add some binding ability to the tokens - that is, glue them to a particular user or device based on some simple crypto. The u
Recipes for Digital Identity & Security