title: is it bad to pass jwt token as part of url?
body: <p>Hi currently i have an angular application and java backend. in my angular component html i have some image such as profile photos. the resource that serves the image files is secured with spring security . 
  so my quesiton is it bad to append json web tokens as part of an image url ? can it cause a security breach ? is it a bad practice ?</p>
  
  <p>the following is how my angular code looks like from the chrome developer tool. </p>
  
  <pre><code>&lt;div _ngcontent-c5="" class="avatar-circle bg-secondary text-brand-secondary" ng-reflect-klass="avatar-circle" ng-reflect-ng-class="bg-secondary,text-brand-second" style="background-image: url(&amp;quot;http://localhost:8080/api/files/4eb81fa8-9c5d-4920-b0f5-c9239fb1cae7?access_token=eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJnbG9iYWxhZG1pbkBsb2NhbGhvc3QiLCJhdXRoIjoiUk9MRV9HTE9CQUxfQURNSU4iLCJleHAiOjE1NjExOTkwNTh9.UFvdgZNxs_O1uTjtUh64ko3A47R2fxZxYFX0aXv2Jp_TkVrmlBT1mzN40JwclGk3m0sCZONKbnVhgXXKy69DfQ&amp;quot;);"&gt;
    &lt;!--bindings={
    "ng-reflect-ng-if": "false"
  }--&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>any help is appreciated . i would love to pass the access_token as part of the http get request header but i couldnt find a proper code anywhere. any help is appreciated.</p>