New answers tagged oauth
You can use browser + PIN-code verification (oauth_callback=oob). It will become semi-automatic, but will allow you to avoid creating "custom url scheme" see this article, for example
An OAuth token is a session id used to maintain an authenticated state and like a password it must be protected. In the case of a backbone.js client an attacker could obtain this value using xss. Storing the oauth token as a cookie allows for the use of the httponly flag which prevents an xss payload from reading this value. even if the oauth token is ...
After a lot of research, I've discovered that Google has an Unsecured Access Token verifier - https://developers.google.com/accounts/docs/OAuth2UserAgent#validatetoken which can be used to verify What application the Token was issued to Which email address the token was issued on behalf of. By keeping track of the application's Google Identifier, The ...
I think the solution you propose is the best you are going to find. Lets recap your problem to check I understand correctly. You have a "Data Layer" which stores data owned by users. Users are authenticated using Google's OAuth endpoint. You also have a number of "Front end" apps that can access the data layer, but are not implicitly trusted. The behaviour ...
Top 50 recent answers are included