Tokens are not stored securely

[al-yisun]

As per the RFC, "[tokens] MUST be kept confidential in transit and storage." This can be accomplished pretty easily here by storing a hash of the token string instead of the token string itself, although perhaps that logic should be bubbled up into Flask-OAuthlib as well.

[matt3o]

Isn't that the actually the case? Transport is protected by https, and the token is stored in a SecureCookieSession from Flask. I see your point but I don't think it's necessary. Please correct me if I'm wrong, about to implement an OAuth2 component myself.

[lepture]

SecureCookieSession is not that secure.

This is just an example, you should store it in your database.