I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something.
I understand that the client authorises with the OAuth provider (Google for example) and allows the Resource Server to have access to the user's profile data. Then the client can send the access token to the resource server and be given back the resource.
But what does not seem to be covered in any of the documentation is what happens when the client app asks the resource server for a resource and passes it the access token. Everything I have read so far states that the resource server just responds with the requested resource.
But that seems like a huge hole, surely the resource server must somehow validate the access token, otherwise I could just fake up any old request and pass an old, stolen, fake, or randomly generated token and it would just accept it.
Can anyone point me at a simple to follow explanation of OAuth2 because so far the ones I have read feel incomplete.