I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly working fine. Recently I found that some users using a web proxy like Fiddler to sniff the application traffic and monitoring application WSDLs, request and responses. I introduced JWT(JSON Web Token) to prevent man in the middle attack, but again, JWT messages can be captured and decoded to see original requests and responses.
I found another way to protect application request and response is to encrypt individual packets before send using any symmetric key algorithms such as AES or zip up with AES encryption. But this will affect performance of the application badly.
Is there any other way to address this issue without affect much on application performance?