I am new to security and I am wondering if JWT is secure enough.
From what I have read online the flow goes like this:
- Clients log in by sending their credentials to the identity provider.
- The identity provider verifies the credentials; if all is OK, it retrieves the user data, generates a JWT containing user details and permissions that will be used to access the services, and it also sets the expiration on the JWT (which might be unlimited).
- so on...
Wouldn't Part 1 be vulnerable as it is not encrypted or am I missing something?