https://oa.dnc.global/Verifying-the-origin-of-the-request-received-by-a-resource-server.html The transmission of tokens to protected resources implies that the latters are receptive to tokens of any origin. This presents an opportunity for an attacker (a foreign application) to exploit a compromised or stolen token. Once more, the analysis reveals that we are only able to ensure data security in the case of the "Authorization Code" flow. Consideration about the security of token transmission to resource servers (RS) The proposed RFC 6749 standard is quite clear on the need to (…) en SPIP - www.spip.net https://oa.dnc.global/local/cache-vignettes/L93xH94/arton149-a6631.png?1794159869 https://oa.dnc.global/Verifying-the-origin-of-the-request-received-by-a-resource-server.html 94 93