As support for OAuth 2 relies on the trustworthiness of the OAuth 2 provider and the verifiability of the provider's response, security and authenticity are critical in order for the application to have confidence in the user's OAuth 2-based login.
Fortunately, the designers of the OAuth 2 specification were very aware of this concern, and implemented a series of verification steps to prevent response forgery, replay attacks, and other types of tampering, which are explained as follows:
- Response forgery is prevented due to a combination of a shared secret key (created by the OAuth 2-enabled site prior to the initial request), and a one-way hashed message signature on the response itself. A malicious user tampering with the data in any of the response fields without having access to the shared secret key—and signature algorithm—would...