I want to use OAuth from a famous source (Facebook/Google/GitHub) as a login mechanism for users (for simplicity and to avoid storing passwords).
What are the security risks? Do I really need HTTPS/TLS on my website? Does TLS make it 100% secure?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
No system will be 100% secure. I think that some authentication providers (such as Facebook) will force you to use TLS and will only allow redirections to
https:// sites. If your connection is not secured using TLS, an eavesdropper will be able to see any tokens exchanged in the OAuth authentication process. With Let’s Encrypt available for free, there is really no good argument against even the most basic TLS solution.