Bearer Risk: Token Theft and Session Hijacking in Cloud-Based Identity Federation

Abstract

Cloud-based identity federation allows one authentication event to unlock many applications. The artifacts that carry that trust, such as SAML assertions, OpenID Connect ID tokens, OAuth access and refresh tokens, and browser session cookies, are frequently bearer credentials: whoever holds them can use them. Stronger sign-in methods reduce password theft but do little to protect these artifacts after authentication. This paper presents a six-stage lifecycle threat model for token theft and session hijacking, reviews publicly reported incidents that illustrate each stage, and proposes the Bind, Limit, Detect and Revoke (BLDR) framework of complementary controls. We outline an implementation sequence, a controlled evaluation design and a set of metrics, including time to invalidate a stolen token and binding coverage. The contribution is conceptual: a structure for deciding which federation controls to deploy first and how to tell whether they are working.