I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0.
In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to Service Provider.
What I don't fully understand is how are these tokens secured so nobody can steal it and use it from different device in order to get authenticated session and impersonate.
Also, how are these tokens stored? Are they stored as a cookie in a browser? If so, would it be possible to steal a token cookie and use it to impersonate somebody?
How can I detect that the token is used in an unauthorised manner?
I am looking for a practical view how are tokens secured and represented when authentication is established or when using as SSO, so authentication is not required by Identity Provider.