JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair.
Still, I don't fully understand the benefits that it gives. I have two questions:
- To get the token, user still needs to send his credentials to some server that issues these tokens. Isn't it a weak point of all this?
- If attacker steals the token while it's being transferred, he can use it to pretend he is someone else. The only difference between this and using user/password combination is that JWT tokens get expired after some period of time, so attacker doesn't have much time to do his thing.
Is my understanding correct? What am I missing? What are real advantages of using JWT vs user/password?