JWT & OAuth2 - Does the server store the token? & How are they Secure/Hacker Safe?
<p>I am a complete noob when it comes to security, authentication strategies. So I was reading this article about "Token Based Authentication":
<a href="https://scotch.io/tutorials/the-ins-and-outs-of-token-based-authentication" rel="noreferrer">https://scotch.io/tutorials/the-ins-and-outs-of-token-based-authentication</a></p>

<p>I have 2 questions:</p>

<ol>
<li><p>I don't understand why a middleman(or a hacker) would not be able to see the token being sent by the client and use the same to impersonate as that client/person to retrieve resources? What makes JSON Web Tokens / OAuth2 based authentications safer in that sense? If we use a onetime-use-only token every time, I would understand that even if the hacker can read the token he will not be able to use it for another request. But as the token stays the same until it expires, how is that a safer authentication strategy?</p></li>
<li><p>How does the server know that the token sent by the client is valid i.e something that the server exchanged with the client during login. Does the server store the token generated in a database or somewhere and keep updating the "last accessed timestamp" or something and keeps removing the tokens where last_accessed_time is > 1hour ago, to keep expiring it after 1 hour of inactivity?</p></li>
</ol>