问题
It may be a stupid or naive question, but: Are OAuth2 bearer tokens signed?
To put it in other words: Is the consumer able to verify whether the bearer token was issued by a specific authorization server?
回答1:
No. But there are efforts under way to fix this. HTTPS ensures the token was transmitted securely, but it doesn't tell you who issued the token.
回答2:
Actually you have to use oauth over https which is going to be responsable of signing
来源：https://stackoverflow.com/questions/16065497/are-oauth2-bearer-tokens-signed