I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my backend with the access Token that is being transferred.

My question is that I some person somehow got hands on a user's access token so when he does that the account can be taken-over by the attacker. How can I solve this issue?

What I thought was to "Send a JWT token in the body embedding the access token and later verify with the server with the header access token" but I thought that's some thing fishy. Am I right in my solution? if there is any better solution Please suggest it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.