title: What if JWT is stolen?
body: <p>I am trying to implement stateless authentication with JWT for my RESTful APIs.</p>
  
  <p>AFAIK, JWT is basically an encrypted string passed as HTTP headers during a REST call.</p>
  
  <p>But what if there's an eavesdropper who see the request and <em>steals the token</em>?  Then he will be able to fake request with my identity?</p>
  
  <p>Actually, this concern applies to all <em>token-based authentication</em>.</p>
  
  <p>How to prevent that? A secure channel like HTTPS?</p>