https://medium.com/@igventurelli/common-oauth2-misconceptions-debunking-myths-for-a-secure-implementation-7f273beff545