0

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my backend with the access Token that is being transferred.

My question is that I some person somehow got hands on a user's access token so when he does that the account can be taken-over by the attacker. How can I solve this issue?

What I thought was to "Send a JWT token in the body embedding the access token and later verify with the server with the header access token" but I thought that's some thing fishy. Am I right in my solution? if there is any better solution Please suggest it.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.