I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I understand it, this is a standard way to implement JWT.
I am trying to understand the difference between the way that this initial /Token endpoint is called; and calling an API that uses Basic authentication. With Basic authentication, the username and password would be passed in the Authentication header; and then validated on the server side. This seems to be the same basic idea as what we are already doing; except that instead of passing username and password in the authentication header, it is being passed in the request body.
Is there a security difference between these two methods of passing username and password to an API? Would it make sense to implement Basic authentication on our /Token endpoint instead? (Currently there is no Authentication header; but the server will return 401 if the username and/or password are missing or incorrect).
If it matters, the API is written in .Net Core; I'm aware that there are differences in terms of how the server code is written (data in the authentication header can be automatically validated using the [Authorize] attribute on the methods); but I am wondering about security differences in the actual data transfer.