1

I want to use OAuth from a famous source (Facebook/Google/GitHub) as a login mechanism for users (for simplicity and to avoid storing passwords).

What are the security risks? Do I really need HTTPS/TLS on my website? Does TLS make it 100% secure?

closed as too broad by S.L. Barth, Steve, Xander, Serge Ballesta, CaffeineAddiction May 10 '17 at 14:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Yes do you. HTTPS is better than no security (http). – Tom May 9 '17 at 14:07
2

No system will be 100% secure. I think that some authentication providers (such as Facebook) will force you to use TLS and will only allow redirections to https:// sites. If your connection is not secured using TLS, an eavesdropper will be able to see any tokens exchanged in the OAuth authentication process. With Let’s Encrypt available for free, there is really no good argument against even the most basic TLS solution.

Not the answer you're looking for? Browse other questions tagged or ask your own question.