Tag Info

New answers tagged

0

OAuth 2.0 pretty much requires HTTPS, as it doesn't have any means to make tokens secure. So, if google and facebook actually allow you to use OAuth2 over plain HTTP that is bad. Are you sure that is the case? I thought both of them are https-only for quite some time. On the other hand, OAuth1 works fine over plain HTTP as it has it's own layer of secure ...


1

The difference is : OAuth 2.0 is a standardized protocol, and there is many implementations in differents langages (JAVA, Python, PHP, JavaScript...etc) for both client and server sides. So you don't need to follow this article to implement something which "seems" similar to the OAuth 2.0 protocol and probably not secured. For the cookie-based token ...


10

OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are ...



Top 50 recent answers are included