I'm using OAuth2 to secure an API. This API will be used solely by a known website and some Cordova apps.

  • The website will send always send a corresponding referer header.
  • The Cordova app will always send an x-requested-with header.

I have two similar questions regarding this.

  1. May (or should) these headers be used to verify a client identity when requesting an access token?
  2. May (or should) these headers be used in addition to the granted access token to verify the client identity?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.