CORS Cross-origin resource sharing And Json Web Token
<p>In my application I have included a page from a different server/domain. For simplicity I will refer to my main application <strong>Web A</strong>, and the other <strong>Web B</strong>. </p>

<p>Somewhere i <strong>A</strong>, after the user has logged in, I will load a page from <strong>B</strong> by using CORS and jwt. 
In <strong>A</strong> I create an encoded token that I pass to Ajax. Ajax adds this token inside the Header( <strong>"Authorization"</strong> = <em>bearer + encoded token</em>). </p>

<p><strong>B</strong> then uses this token to decode and grab usersId and group it belongs to, and determine whether or not user has access to the resource. 
In addition there is also an <strong>Access-Control-Allow-Origin</strong> = <em>Web A</em> setup inside Web B, to only accept request from A. </p>

<p>My question is about the security part of CORS and the usage of jwt.
During development, when using Postman to access the resources in <strong>B</strong> directly, I could easiy bypass <em>"<strong>Access-control-allow-origin</strong>"</em>. 
And as long as I had the correct token, the resources were sent back with no problem! I mean all it takes is for some potential hacker to get hold of that encoded string, and they could easily use Postman to view the resources. </p>

<p>What is the next step here when it comes to the security part, because I'm completely lost!</p>

<p>Hope I explained the issue clearly. All help is highly appreciated</p>