There is a lot of talk about the importance of securing jwt token on frontend frameworks such as react, whether by hiding it in memory or storing it as an httponly cookie. But what is confusing is, why do all this when the token is visible in a request header to an API in dev tools?
Authorization: Bearer (token)
Is there a way to hide the token from devtools? Or are there other ways to handle this?