I'm building a small site which I would like to integrate with LinkedIn for authentication. LinkedIn says that redirect_uri's can be either http:// or https:// (not having to pay for a certificate is really awesome right now)
Upon reviewing the OAuth2 spec, I can't wrap my head around the possibility of exchanging a token via plaintext as not being prone to vulnerabilities. I know this is a basic question, as I'm pretty new to the crypto world. And of course I know that such an obvious vulnerability (if existent) has been already addressed.
The question is: how? How does the spec deal with the token being sent to the user agent in plain-text and redirected to the client in a potentially non-secure way?