Tokens (JWT, session tokens, API keys, CSRF tokens) prove the bearer has a specific right. Different tokens have different scopes and expiries. Rule: rotate tokens on suspicious activity; never log full token values.
Tokens (JWT, session tokens, API keys, CSRF tokens) prove the bearer has a specific right. Different tokens have different scopes and expiries. Rule: rotate tokens on suspicious activity; never log full token values.