If your token is invalidated and regenerated after every request, this mitigates a token leaking (unless the browser extension intercepts your call and uses the

If your token is invalidated and regenerated after every request, this mitigates a token leaking (unless the browser extension intercepts your call and uses the token immediately... at which point your user has other problems to worry about!) https://github.com/lynndylanhurley/devise_token_auth#about-token-management https://github.com/lynndylanhurley/devise_token_auth#about-t... has a good example of this. It's nontrivial for either clients or server to implement (the edge cases around overlapping requests require careful thought), but it would likely solve this scenario.