Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks only (facebook, google, etc), assuming that the passwords will be protected since the connection (to the social network only) will be secure. The protocols used will generally be SAML, OAuth2 or OpenID.

I'm simply asking, since I do not know well the specifications of these protocols, is the secure connection between client and website host required for the unique authentication to be secure? In other words, would it be possible to sniff the payload that's keeping the user connected (I guess it's kept in the cookies) and use it?


A quick use of a search engine points me as the first hit to stackoverflow: Are Oauth2 client apps required to have SSL connection? which cites the OAuth 2.0 specification which can be summarized with:

... the authorization server MUST require the use of TLS ... The redirection endpoint SHOULD require the use of TLS ... Access token credentials MUST only be transmitted using TLS

For more information see the original answer at stackoverflow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.