JWT token in URL

[faulkdev]

We are evaluating CSET deployment in the enterprise configuration. We will have the frontend and backend on different servers. We've identified at least 26 instances in which the bearer token is passed via URL (e.g., search "?token="). Even with HTTPS enabled with CSET, this OWASP Number 1 and/or Number 2 vulnerability violates the very security standards implementations we want to document with CSET.