Bearer Risk: Token Theft and Session Hijacking in Cloud-Based Identity Federation
Cloud-based identity federation allows one authentication event to unlock many applications. The artifacts that carry that trust, such as SAML assertions, OpenID Connect ID tokens, OAuth access and refresh tokens, and browser session cookies, are frequently bearer credentials: whoever holds them can use them. Stronger...