Regarding auth0 security

Question

I am implementing auth0 on my site(jQuery) and on server side(Node).

When user logs in idToken is issued, which is further passed to my NodeServer to verify using checkJWT. After verifying I am POSTING https://{AUTH_DOMAIN}/oauth/token with body containing client_secret, clien_id, audience, grant_type . In response I get Access_token. Which I can further use for fetching userDetails or any other api.

I am wondering if user steals the Access_token or idToken and tries to hit API and he would be able to access the data.

How can I manage this...? Or is there anything that I am missing..?

Answer 1

idToken is very short-lived, Access_token also lives not so long, may be even 1 day is I'm not mistaking. So, if Man-In-The-Middle doesn't have access to refresh_token he has only a limited time to login to the system.