Difference between sending OAuth codes and jwt tokens in URL query security

[iKingNinja]

Why is passing OAuth codes in the URL’s query considered safe while doing it with JWTs is not?

If an OAuth code is leaked, the attacker can use it to retrieve the bearer token thus getting access to the user’s resources, likewise if the JWT is leaked the attacker can use it to authenticate himself as the actual user.

I’d like to understand the difference between the two cases as I want to use a SignalR client with the WebSockets protocol, but I somehow need to authenticate the user and since headers can’t be sent using the WebSockets protocol there’s no other way than using the URL’s query. I cannot use ASP.NET authentication as it is handled by a NodeJs server.

[tyf]

Hey there @iKingNinja welcome to the community!

@iKingNinja

Why is passing OAuth codes in the URL’s query considered safe while doing it with JWTs is not?

Neither of these flows (Authorization code nor Implicit) are considered best practice for public applications (SPA, Native) - Authorization code with PKCE is preferred for the very reason you mention, exposing codes/tokens in a url.