Can `Man In Middle Attack` break The CSRF_TOKEN protection?

I am looking into the django csrf_token protection, I have known about how it works, but there is still a question that I want to know.For example, in a http request, if the attacker can sniffer all of a user's network traffic, which means the attacker can still get the csrf_token and make a fake request with the valid csrf_token. As mentioned CSRF, I have the same doubt about JSON WEB TOKEN, if the attacker get a user's TOKEN ,he\she can still make a fake request. Could you please explain if my example description is correct? And if so, what can we do to handle this?