Bearer Token
An HTTP authentication scheme in which a token is stored in a frontend application's memory or local storage and explicitly transmitted via the Authorization request header without relying on browser-managed mechanisms. It is commonly used for API authentication and session management in single-page applications.
Timeline (last 90 days)
Traditional Bearer Tokens have a weakness: once a token is stolen, any party holding it can impersonate a legitimate client to make requests.
Tokens stored in memory are lost after a page refresh, but are more secure because XSS attacks cannot read them via document.cookie or localStorage
Tokens stored in localStorage can persist after a tab is closed, but are exposed to XSS risks
Tokens carrying impersonation claims retain auditability, as the server always knows the identity of the actual operator
Bearer tokens are typically stored in the frontend application's memory or local storage and explicitly transmitted via the Authorization: Bearer <token> request header
It is recommended to set a shorter expiration time for impersonation tokens and to ensure the administrator's original token is always securely retained on the client side.
Implementing user impersonation under a Bearer Token architecture should be designed around the token itself rather than applying cookie-swap thinking, and solutions that can embed real-operator claims should be preferred.
Under the Bearer Token model, exiting impersonation only requires discarding the impersonation token and switching back to the originally held admin token, making the exit path more secure than the cookie-based approach.
All Facts (9)
Traditional Bearer Tokens have a weakness: once a token is stolen, any party holding it can impersonate a legitimate client to make requests.
50%UnverifiedBearer tokens are typically stored in the frontend application's memory or local storage and explicitly transmitted via the Authorization: Bearer <token> request header
50%UnverifiedTokens stored in memory are lost after a page refresh, but are more secure because XSS attacks cannot read them via document.cookie or localStorage
50%UnverifiedTokens stored in localStorage can persist after a tab is closed, but are exposed to XSS risks
50%UnverifiedUnder the Bearer Token model, exiting impersonation only requires discarding the impersonation token and switching back to the originally held admin token, making the exit path more secure than the cookie-based approach.
50%UnverifiedIt is recommended to set a shorter expiration time for impersonation tokens and to ensure the administrator's original token is always securely retained on the client side.
50%UnverifiedImplementing user impersonation under a Bearer Token architecture should be designed around the token itself rather than applying cookie-swap thinking, and solutions that can embed real-operator claims should be preferred.
50%UnverifiedTokens carrying impersonation claims retain auditability, as the server always knows the identity of the actual operator
50%UnverifiedBearer Token是OAuth 2.0规范中的标准认证方式，任何持有该令牌的请求方都被视为合法用户
50%