3 ms·

The authentication happens on a different site (the Google login site) then, and you only get back a token. The worst the ad could do is steal your token then,

The authentication happens on a different site (the Google login site) then, and you only get back a token. The worst the ad could do is steal your token then, which will only be valid for a little while.

he0001 7y ago
How would an ad possibly steal the token then? Rephrase: how would one make sure it’s protected.
he0001 7y ago
OTOH if it’s so easy to steal it, they could just steal the next one, not needing any credentials at all. Or steal the refresh token?