In a website using JWT based authentication.
Lets say we have multiple users in database such as A and B.
The api call called fetch/user/ should return user’s data from database based upon the param.
Also, as this API is called after authentication, the user sends JWT as Auth header.

Now lets consider this scenario. I as User A log into the website.
I call /fetch/user/A to get my data.
I inspect the Chrome dev tools and copy my JWT.

I open POSTMAN, then put the request as /fetch/user/B and use my auth JWT token.

To my surprise, it returns the data of user B.

Expectation user A’s JWT should not return data for any other user. Seems like only JWT gets verified, not user specific data.
Considering that the basic JWT setup is used as shown in multiple JWT tutorial pages, how do we resolve this issue?