CODEWITHSUNDEEP
facebookgoogle-app-engineoauth-2.0
Houman
Houman

Reputation: 66320

Is https necessary when using Oauth2.0?

Our users can only use Facebook Oauth2.0 to signup and connect with our service on google app engine.

Is it in this case even necessary to have the connection secured over https? Would the secret token be still in danger to be sniffed by a man-in-the-middle-attack? Or can we leave it by that?

Usually https is a must if username/passwords are used to protect plain passwords over the wire. Not so sure about oauth 2.0.

Thanks,

Upvotes: 1

Views: 70

Answers (1)

Peter Knego
Peter Knego

Reputation: 80340

Yes it's necessary. Secure token is a credential as much as username/password are. If someone sniffs it out they can hijack users session for as long as token is valid.

Upvotes: 4

Related Questions