Why is passing OAuth codes in the URL’s query considered safe while doing it with JWTs is not?
If an OAuth code is leaked, the attacker can use it to retrieve the bearer token thus getting access to the user’s resources, likewise if the JWT is leaked the attacker can use it to authenticate himself as the actual user.
I’d like to understand the difference between the two cases as I want to use a SignalR client with the WebSockets protocol, but I somehow need to authenticate the user and since headers can’t be sent using the WebSockets protocol there’s no other way than using the URL’s query. I cannot use ASP.NET authentication as it is handled by a NodeJs server.