We are integrating into a system and I have some concerns over the security. As a test, I have taken a bearer token that was issued in a request 2 months ago and managed to perform a successful, authenticated request to the test system.
The live system blocks requests using older tokens, which is good. However, it suggests that the live system has the potential to be either storing older tokens or the potential (with maybe an unintentional change) to accept older tokens.
I'm quite concerned that the test system would be developed in a way that allows reuse of tokens. Should this be a concern and what are the potential implications?
Thanks in advance
Update: We have now found that some tokens are reusable on the live system as well.