Who gets a bearer token, will have all the privileges of the actual owner of the token. Is there any tokening mechanism which is not suffering from this issue?

1 Answer 1


There's HMAC/signature based authentication. With HMAC/signature, the secret token is never sent over the wire, but instead the message only contains the MAC/signature, which is valid only for that particular message and cannot be copied to a different message. The MAC/signature is calculated based on a secret token on the client machine and the hash of the message.

Most HMAC/signature based authentication uses software token, which is fine for most purpose, but if you also want to prevent the the token from being duplicated, you can also use hardware based token. With hardware based token, the secret token is kept on a cryptographic HSM which is not accessible to application code.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .