What is a Bearer token and how is it used in the Authorization header?

Question

ICSM Computer · Answer

What is a Bearer Token? A Bearer token is a type of access token used in token-based authentication, typically JWT (JSON Web Token), which proves the identity of the client to a server. The term “bearer” means that whoever possesses the token is granted access — no additional proof is needed. Format in HTTP Request Bearer tokens are sent in the Authorization header like this: Example: Why It's Called "Bearer" It means "whoever bears (holds) the token gets access" — just like cash: anyone holding it can spend it. So: Protect the token like a passwordNever expose it in URLs or public places Typical Flow of Bearer Token Usage Client sends credentials to /api/auth/login: Server responds with token: Client stores the token (e.g., in memory, localStorage, or sessionStorage)Client includes the token in Authorization header for all future requests: Server validates the token and processes the request if valid. Server-side Token Validation (ASP.NET) In .NET Core: In .NET Framework: Use middleware like Microsoft.Owin.Security.Jwt Best Practices Practice Reason Use HTTPS only Prevent token sniffing Set short expiration times Limit impact if token is leaked Use refresh tokens if needed Maintain security with longer sessions Never store tokens in URLs Can be leaked via logs or referrers Summary Term Meaning Bearer token A token that grants access when "borne" (held) Authorization header Where the token is sent in HTTP requests Usage Authenticates API requests

Practice	Reason
Use HTTPS only	Prevent token sniffing
Set short expiration times	Limit impact if token is leaked
Use refresh tokens if needed	Maintain security with longer sessions
Never store tokens in URLs	Can be leaked via logs or referrers

Term	Meaning
Bearer token	A token that grants access when "borne" (held)
Authorization header	Where the token is sent in HTTP requests
Usage	Authenticates API requests

interview

What is a Bearer token and how is it used in the Authorization header?

Can you answer this question?

1 Answers

What is a Bearer Token?

Format in HTTP Request

Example:

Why It's Called "Bearer"

Typical Flow of Bearer Token Usage

Server-side Token Validation (ASP.NET)

Best Practices

Summary