Lets assume that i have create website which in every request to API lets say send JWT token and CSRF token. So let's create case like that:

I'm logged in to user A and make ajax request to API with JWT and CSRF token. I go to networking and read this tokens and copy them.

Next i go to eg another server or injecting progam and inject this JWT and CSRF token. Will i will be able to recieve data ? If yes/no why ? I need to add that cors is disabled

Looking forward for replies. Thank You very much and regards

  • 1
    I go to networking and read this tokens and copy them. How exactly? Is this connection not using TLS?
    – John Wu
    Commented Mar 16, 2017 at 17:39
  • It's inside ajax request i pass jwt and csrf and i can view it on page source, and copy them and inject eg on another server
    – Juri Bojka
    Commented Mar 16, 2017 at 17:45
  • 1
    Do you mean send the request to a different server? Or send from a different server, to the same service?
    – John Wu
    Commented Mar 16, 2017 at 18:02
  • Fro@ different servet to the same service
    – Juri Bojka
    Commented Mar 16, 2017 at 18:05

2 Answers 2


It sounds like you aren't clear on what how these tokens are used.

A JWT is a type of "Bearer token": this is a token created by a particular server and given to a user to keep secret. The user can later show this token to the server to prove their identity.

It is very similar to a password - you send your password to a website, and the server thinks "this person knows the password, so it must be the correct user". However, sending your StackExchange password to Yahoo Mail won't let you log in, because Yahoo won't recognise the password for an unrelated website. However, if you take your password/token and use it in a different browser for StackExchange, then it will still let you in - which makes sense, because it is your password/token.

A CSRF token is a different type of token, used to prevent a different attack, but it will still only work for the servers that recognise it, much like a password or a JWT / Bearer token.


It depends on the service.

In some cases, the tokens may be bound to your IP address, e.g. via a database record held by the service. In other cases the token is good no matter where you send it from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .