I want to use OAuth from a famous source (Facebook/Google/GitHub) as a login mechanism for users (for simplicity and to avoid storing passwords).

What are the security risks? Do I really need HTTPS/TLS on my website? Does TLS make it 100% secure?

  • Yes do you. HTTPS is better than no security (http). – Tom May 9 '17 at 14:07

No system will be 100% secure. I think that some authentication providers (such as Facebook) will force you to use TLS and will only allow redirections to https:// sites. If your connection is not secured using TLS, an eavesdropper will be able to see any tokens exchanged in the OAuth authentication process. With Let’s Encrypt available for free, there is really no good argument against even the most basic TLS solution.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.