I want to start using JWT to access an API endpoint that needs to be protected. There will be no logged in user, as this will be an HTTP call coming from a Vue frontend running on the same server.
What I'm not understanding is how this method protects the username and password from the public?
I read this article which states the username/password combo is posted in the body content over to the server:
Can't anyone just inspect that request and get my login credentials by decoding the base64 string? I don't understand how this is safe. I'm sure I'm missing something in my understanding.