Bearer Tokens and Sessions
Bearer and cookies both carry session proof — use 127.0.0.1:8812.
Visual · authn_bearer_sessions
Authorization: Bearer … vs Cookie sessions. 127.0.0.1:8812.
Bearer means “whoever holds this string acts as the subject” — which is why theft equals login.
APIs often use Authorization: Bearer <token> after a login exchange. Browsers may instead hold an HTTP-only session cookie. Both are session proof. TLS protects them on the wire; your notes and clipboard hygiene protect them at rest. Original Cyberlium. Practice a lab bearer on 127.0.0.1:8812. You will NOT steal cookies from other browsers, not phish “login with Google” clones, not hydra password forms on strangers. Next: Authn vs Authz.
1. Bearer is a capability in a string
Anyone who can send the bearer token can call as that subject until expiry or revocation. Treat lab tokens like passwords: 600 files, no screenshots to group chat.
curl -H "Authorization: Bearer lab-token" against YOUR toy. Compare to missing header → 401.
Command guide
Try these commands — Bearer is a capability in a string
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Session vs token — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html Bearer tokens — https://oauth.net/2/bearer-tokens/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -H "Authorization: Bearer lab-token" http://127.0.0.1:8812/me
curl -sS -b "session=lab-cookie-value" http://127.0.0.1:8812/me
curl -sS -o /dev/null -w "no auth %{http_code}
" http://127.0.0.1:8812/mePrimary tools to practice this lesson: curl. Reference sites: Session vs token (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html); Bearer tokens (https://oauth.net/2/bearer-tokens/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sessions and cookies are still credentials
Cookie-based sessions need Secure/HttpOnly/SameSite in real apps. On the lab, notice Set-Cookie if present and never replay a classmate’s cookie file.
Bearer vs cookie is transport packaging. The security question is still: who proved identity, and for how long?
3. What you will not do with “session practice”
XSS kits to steal cookies. Evil twin Wi-Fi to sniff tokens. Fake OAuth consent pages. Those are attacks, not literacy.
Ship a note: bearer present → 200; absent → 401 on 127.0.0.1:8812.
4. What you ship: bearer present/absent proof on YOUR lab
401 without bearer, success with lab bearer. Cookie ethics noted. DEMO GATE. Dest 127.0.0.1:8812. No phishing kits. No token theft labs on strangers.
5. What you record before the next lesson
Date. Bearer test results. NEVER classmate cookies. File t13-m03-l02-bearer-sessions.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Export a friend’s browser cookies “to learn sessions.” Stand up a fake Google login. hydra /login on a public site.
- Right: Lab bearer only. Next: Authn vs Authz.
Mission: prove bearer gating without theft theater
1) / STOP if router. 2) curl YOUR 8812 routes with and without Authorization: Bearer. 3) Write theft=login warning in notes. Never phish. Never steal cookies.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor how to pass Authorization in curl — not how to bypass someone else’s SSO.
APPLY: True or False: Holding a bearer token is enough to act as that subject until revoke/expiry.
APPLY: A zip includes a “Google OAuth phishing kit.” You:
APPLY: Missing Authorization on a bearer-gated lab route should yield:
Authn vs Authz
Part of API Security with AI — Authentication for APIs.
Auth Lab — Keys and Bearer
Part of API Security with AI — Authentication for APIs.
Quiz — API Authentication
Part of API Security with AI — Authentication for APIs.