title: Stealing access tokens in oAuth2
body: <p>If using the clientside flow, the callback URL contains the access token. So if the callback URL is sent over HTTP, isn't it vulnerable to being captured and misused.</p>
  
  <p>If user 2 of my app, gets the access token of user 1, he can get access to user 1's account.</p>
  
  <p>Also if the user copies the callback URL and sends it to someone, he is unknowingly sending the other person access to his account.</p>
  
  <p>I can think of some ways of mitigating this - make callback url HTTPS, and on the client script remove the access token from the URL etc. Is that how you are expected to deal with this</p>