What is a security token used to authenticate a user to a web application, typically...

A session token is used to maintain a user’s authenticated state after login. Once a user successfully authenticates, the server issues a session token that is stored by the client and sent with subsequent requests.

The server uses this token to identify the user without requiring reauthentication on every request. Session tokens must be protected against theft through secure cookies, encryption, and proper expiration.

CAPTCHAs prevent automated abuse, API keys authenticate applications, and CSRF tokens prevent request forgery. Only session tokens authenticate users across requests.

Proper session management is critical for web application security and is emphasized in OWASP and NIST guidance.