All IAM glossary termsFundamentals · glossary
Session Token
Also known as: Session ID · Session Cookie
Definition
A session token is the credential issued after authentication that represents an ongoing session — typically a cookie, opaque token, or JWT — used to authenticate subsequent requests without re-authentication.
In more depth
Session tokens come in several flavors: HttpOnly cookies (traditional web), bearer tokens (APIs, OAuth access tokens), and short-lived JWTs paired with refresh tokens (modern SPAs / mobile).
Session token security: HttpOnly + Secure + SameSite cookies for browser sessions; short TTL + rotation for OAuth tokens; token binding (DPoP, mTLS) for high-security contexts. The 2023-2024 wave of session-token theft attacks (Lapsus$, Scattered Spider) drove broad adoption of binding patterns.
Want the work, not just the definition?