A token is sent or received over an unencrypted HTTP connection. A JSON Web Token is a bearer credential: whoever holds it is treated as its owner. Anyone who can observe the traffic, for example on a shared wireless network or at an intermediate hop, can copy the token and replay it.

1. Serve the whole application over HTTPS and redirect HTTP to HTTPS.

2. Enable HSTS so that browsers never attempt a plain HTTP connection.

3. Mark cookies that carry tokens Secure so they are never sent over HTTP.

• CWE-319: Cleartext Transmission of Sensitive Information
• OWASP JSON Web Token for Java Cheat Sheet