Possession is the credential
01A bearer token can be used by any party possessing it, without proving possession of a cryptographic key.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 1.2 ↗
RFC 6750 · § 1.2EXAMPLE
3 / 3
03
Bearer replay
Possession alone can let the thief act within the token’s privileges.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
RFC 6750 bearer possessionRFC 9700 § 2.2
The OAuth security BCP recommends sender-constraining access tokens to reduce the consequences of replaying a stolen token.
Read the updated RFC section ↗Protect bearer tokens from disclosure in storage and transit.
- Protect bearer tokens from disclosure in storage and transit.
- A copied token may be replayed by its possessor.
- Sender-constrained tokens add a different proof requirement.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy