JWT is used as user authentication in my project. If someone intercepts packets(using wireshark, etc), takes the user's jwt token, and then tries to log request in using the jwt token(replay attack) how can i defend using jwt? (my project is using https)
ps. English is not my native language, so I am not good at it, so please understand the awkward sentences.
A JWT literally IS your access token. So you have to keep it secure and especially transfer it securely by all means. If an attacker was able to obtain a JWT (for example by sniffing an unencrypted HTTP connection) he can always* use it to perform any action the user (respectively the token) is authorized to. So it's more of a use than a "replay attack".
Therefore you cannot directly defend using a JWT. You can only make sure to send it always over an encrypted HTTPS connection and to prevent Cross-Site-Scripting attacks, which could allow an attacker to steal the JWT.
* Because of this, a JWT generally has an expiration time. So if you keep the expiration time short an attacker could use the stolen JWT only in a small time period. However, also a small time period may be sufficient to achieve permanent access. And the attacker could possibly steal a fresh JWT via the initial source.
