Home/ Questions/Q 7054343
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T03:36:54+00:00

I am creating a chrome extension, where i plan to use OAuth2 client side

  • 0

I am creating a chrome extension, where i plan to use OAuth2 client side flow for authentication. As per the specs for both google and facebook, when i use client side flow, I get the access token as part of the hash part of the redirect_uri. Now my question is this -> what if a rogue extension transfers that access token to another extension on some other machine, which then uses that access token to get user details? I am quite novice with web development and ouath and would appreciate if somebody could clarify this doubt for me

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The Facebook OAuth2 implementation requires that you use SSL (https) which means that other people cannot see that token unless you explicitly give it to them outside of the browser itself (or using an evil plugin, as noted).

    There’s a great post on this topic here: http://www.sociallipstick.com/?p=239

    • 0