security - Is it safe to put a jwt into the url as a query parameter of a GET request?

Question

Is it safe to put a jwt (json web token) into the url as a query parameter of a GET request?

Answer 1

It can be safe under the following circumstances:

1. the JWT is one-time time usage only
2. the jti and exp claims are present in the token
3. the receiver properly implements replay protection using jti and exp

but in case it is used as a token that can repeatedly be used e.g. against an API then supplying it as a query parameter is less preferred since it may end up in logs and system process information, available to others that have access to the server or client system. In that case would be better to present it as part of a header or a POST parameter.

Besides that, by using it in the query parameters you may run in to URL size limitations on browsers or servers; using it in a header provides some more space, using it as a POST parameter would work best.