Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks only (facebook, google, etc), assuming that the passwords will be protected since the connection (to the social network only) will be secure. The protocols used will generally be SAML, OAuth2 or OpenID.
I'm simply asking, since I do not know well the specifications of these protocols, is the secure connection between client and website host required for the unique authentication to be secure? In other words, would it be possible to sniff the payload that's keeping the user connected (I guess it's kept in the cookies) and use it?