ASP.NET Core Web API Interview Question #56

What is bearer token authentication?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Bearer authentication means possession of the access token is sufficient to present it as a credential. The client normally sends the token in the HTTP Authorization header using the Bearer scheme.

Detailed Explanation

Bearer authentication means possession of the access token is sufficient to present it as a credential. The client normally sends the token in the HTTP Authorization header using the Bearer scheme.

Because a stolen bearer token may be usable by an attacker until it expires or is otherwise rejected, tokens must be protected in transit and storage and should have appropriately limited scope and lifetime.

Code Example

GET /api/orders
Authorization: Bearer {access_token}