A token is part of a URL, in the query string, the path or a redirect target. URLs are stored and shared in many places that are not designed to protect credentials: browser history, server and proxy access logs, analytics tools, bookmarks, and the Referer header that is sent to third party sites.

Anyone who can read one of these copies can use the token for as long as it is valid.

1. Move the token out of the URL. Send it in the Authorization header, in a Secure, HttpOnly cookie or in the body of a POST request.

2. Use short lived, single use tokens for links that cannot avoid carrying one, such as e-mail confirmation links.

3. Set Referrer-Policy: no-referrer (or same-origin) on pages that have to handle such URLs and keep them out of third party scripts and analytics.

• CWE-598: Use of GET Request Method With Sensitive Query Strings
• OWASP JSON Web Token for Java Cheat Sheet