Is access token secure?

Is access token secure?

Access tokens are largely used in the context of mobile banking, to connect between the application and third-party APIs and, as such, they must be treated as a critical security parameter. Web applications usually require authentication from the user. In all cases, a secret is shared by the user and the remote server.

Can access tokens be stolen?

Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering and typically requires user action to grant access.

What can access tokens be used for in an API?

Note: Access Tokens should be treated as opaque strings by clients. They are only meant for the API. Your client should not attempt to decode them or depend on a particular access_token format. Now that we saw what these tokens can be used for, let’s see what they cannot be used for.

Why do resources always own their access tokens?

This is why a resource setting accessTokenAcceptedVersion to 2 means that a client calling the v1.0 endpoint to get a token for that API will receive a v2.0 access token. Resources always own their tokens (those with their aud claim) and are the only applications that can change their token details.

What can an attacker do with access tokens?

Sure, that attacker can then use your application to access APIs on behalf of the compromised user. But if you’re storing access tokens in your application and an attacker gets one, then at a minimum the attacker can use the token to the extent of its scope. The scope of the token certainly may exceed what’s used by your application.

What happens when a Microsoft access token expires?

When the access token expires, the client must use the refresh token to (usually silently) acquire a new refresh token and access token. You can adjust the lifetime of an access token to control how often the client application expires the application session, and how often it requires the user to re-authenticate (either silently or interactively).