From my understanding of JWT Bearer Authentication, a web server reads the Authorization header served with each request to get info on the user that is currently logged on. If no Authorization header token is present in the request, or if the token is invalid, then the server will deny access to the resource.
I frequently see examples on the internet where developers will save a JWT Access Token as a JavaScript variable, and attach it to the Authorization header of XMLHttpRequest (Ajax) calls in order to communicate with secured APIs.
Isn't this similar to saving a password in plain text in JavaScript? What's stopping someone from just creating their own access token at https://jwt.io, and sending it with each request to impersonate any user they want?
It even says on the front page of jwt.io:
Warning: JWTs are credentials, which can grant access to resources. Be careful where you paste them! We do not record tokens, all validation and debugging is done on the client side.