Re:Show HN: A microservice that makes adding authentication ...
by Cyph0n on Sunday February 19, 2017 @08:27PM
(#13683501)
Agreed. The token should be used only after the user is authenticated through another channel (e.g., username+password).
Otherwise, an attacker could obtain the target's OAuth token by getting the target to provide the token to a malicious application. The attacker can then easily authenticate through your library.
Otherwise, an attacker could obtain the target's OAuth token by getting the target to provide the token to a malicious application. The attacker can then easily authenticate through your library.