I'm using JWT for authentication and I use
HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my backend with the access Token that is being transferred.
My question is that I some person somehow got hands on a user's access token so when he does that the account can be taken-over by the attacker. How can I solve this issue?
What I thought was to "Send a JWT token in the body embedding the access token and later verify with the server with the header access token" but I thought that's some thing fishy. Am I right in my solution? if there is any better solution Please suggest it.