Cybersecurity glossary
What is Token Replay?
Learn what token replay is, how stolen session, bearer, or assertion tokens are reused by attackers, detection ideas, and defenses including short TTLs and sender constraints.
Definition
Token replay is an attack in which an adversary captures a valid security token—such as a session cookie, OAuth access token, refresh token, or federation assertion—and reuses it to impersonate the legitimate subject until the token expires or is revoked.
Why stolen tokens are often enough
After login, many systems trust the token more than the human. Token replay skips credential guessing entirely: copy a still-valid cookie or bearer token, present it, inherit the session.
It is one of the most practical post-phishing and post-XSS impact paths.
Replay attack sequence
Token is exposed
Leak via XSS, logs, malware, misdirected redirects, or insecure storage.
Attacker copies the value
Access token, refresh token, session ID, or assertion is captured.
Replay against the service
Requests include the stolen credential from attacker infrastructure.
Authorization succeeds
If still valid and unconstrained, APIs treat the attacker as the victim.
Persistence until stop
Continues until expiry, rotation conflict, or explicit revocation.
Replay surfaces by token type
Browser sessions
Stolen cookies replay into web apps, especially without binding.
OAuth access tokens
Bearer APIs accept replays from any network path.
Refresh tokens
Silent renewal extends compromise duration.
SAML assertions
Captured assertions reused within NotOnOrAfter windows.
ID tokens at clients
Poor client validation enables injection/replay locally.
Machine tokens
CI secrets replayed across environments.
Controls that shrink replay success
| Control | Effect | Limit |
|---|---|---|
| Short TTL | Smaller window | Immediate replay still works |
| Revocation / introspection | Kill known-bad tokens | Needs detection first |
| DPoP / mTLS binding | Token alone insufficient | Key theft bypasses |
| Refresh rotation | Detect dual use | Must revoke family on reuse |
| Device / network binding | Anomalous replay fails | False positives; proxy users |
Defense checklist
- Prefer sender-constrained access tokens for sensitive APIs.
- Keep access tokens short-lived; rotate refresh tokens with reuse detection.
- Avoid putting tokens in URLs, logs, or JavaScript-readable storage.
- Invalidate sessions on password/MFA changes and logout.
- Track token identifiers (jti/sid) to detect concurrent impossible use.
- Use nonce and one-time assertion IDs for federation responses.
- Monitor geographic and ASN anomalies for established sessions.
- Patch XSS and harden cookies (Secure, HttpOnly, SameSite) to reduce theft.
The practical takeaway
Token replay turns a leaked session or API credential into continued impersonation. Prevention is mostly about making tokens hard to steal, quick to die, and useless without proof of possession.
Assume bearer tokens will leak eventually—and design so replay fails loudly and early.
Related security terms
Bearer Token
Possession model that makes replay straightforward after theft.
Sender-Constrained Token
Binding that blocks many replay attempts without the client key.
OAuth Token Theft
How tokens are stolen before replay begins.
Token Revocation
Ends replay windows before natural expiry.
OIDC `nonce`
Helps prevent certain ID token replay/injection cases at clients.
Frequently asked questions
What is token replay in simple terms?
An attacker copies a valid login or API token and uses it again to act as you—like using a stolen wristband to re-enter an event.
Where do replayed tokens come from?
XSS exfiltration, malware, proxy logs, referrer leakage, misconfigured analytics, phishing of session cookies, or network interception without TLS.
Is replay different from password stuffing?
Yes. Stuffing guesses or reuses passwords. Replay reuses already-issued post-authentication tokens.
Do short token lifetimes stop replay?
They shrink the window. They do not help if the attacker replays immediately after theft.
How do sender-constrained tokens help?
Resource servers require proof of a bound key, so a copied bearer string alone fails.
Can refresh token rotation detect replay?
Yes. If a stolen refresh token and the legitimate client both refresh, reuse detection can revoke the token family.
How do you detect token replay?
Look for impossible travel, concurrent sessions, sudden IP changes with the same token IDs, and reuse of revoked jti values.
References
Explore authoritative guidance and frameworks related to token replay.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.