I'm new to OAuth (1 & 2), and I'm developing the server side of a mobile app that has a form with a "Fill Details from Google account" button. I don't need any long-range authentication\authorization.

From here (Listing 2) I understand that the server should have a controller that:

At this stage, my server is suppose to be able to use the access-token to fetch the user's details from https://www.googleapis.com/plus/v1/people/me - and then return the details to the user's app, to fill in its form.

Am I (the server developer) allowed to be lazy and return the access-token to the user, instead of its details? i.e., let the user app make the request to https://www.googleapis.com/plus/v1/people/me.

This will allow, in the future, to give more power to the client app without changing the code on my server.



1 Answer 1


I think you are speaking of the implicit grant which return directly an access token to the client. You have better time to directly look at the RFC.

My thought is it is safe if you use https. If you use JWT (json web token), the access_token can be signed (JSON Web Signature (JWS)) and encrypted (JSON Web Encryption (JWE)) in the payload.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .