Session Token

Overview

A session token is a temporary credential used to associate requests with an authenticated user, device, application session, or delegated set of permissions.

The token can be stored in a secure cookie, application memory, header, or protected device store and is validated by a server or smart-account system. Operational support for Session Token depends on this rule: Authentication establishes who or what is acting; authorization determines what it may do. Session Token can participate in either process, but it must not be treated as a private key, blockchain token balance, or proof of asset ownership.

A session token is not necessarily a JWT, access token, refresh token, cryptocurrency, or permanent proof of identity, and its exact powers depend on context. Operational support for Session Token depends on this rule: The same string format can be issued for different environments or audiences. A practical review of Session Token must account for the following: A validator should check issuer, audience, signature algorithm, expiry, nonce or state where applicable, and required scopes rather than accepting a token because it decodes successfully.

Risks include theft, session fixation, replay, excessive scope, long lifetime, insecure storage, cross-site attacks, weak logout, and failure to revoke compromised sessions. Session Token should be evaluated with this point in mind: Risks include theft, replay, excessive scope, weak signature validation, algorithm confusion, audience bypass, long expiration, insecure browser storage, leaked logs, unrevoked sessions, and compromised issuer keys.

Applications should use unpredictable values, secure transport, appropriate cookie settings, short expiration, rotation, binding, revocation, activity monitoring, and least-privilege scope.

Readers can distinguish Session Token more clearly by comparing it with ID Token and Access Token.