Never, ever use access tokens as proof of identity the way you are doing it. It makes you vulnerable to token substitution attacks. OAuth2 is not an authentication protocol.
I've been recently learning my way around web dev. Most of it is straightforward enough, but security is my sticking point. Everything on the web is contradictory, half explained, and rapidly changing. Seems like you know your way around best practices. Can you point to a decent trustworthy tutorial/book on how to handle logins and identity? Seems like lesson one is "don't implement it yourself" and lesson two is never quite spelled out.
Agreed. The token should be used only after the user is authenticated through another channel (e.g., username+password).
Otherwise, an attacker could obtain the target's OAuth token by getting the target to provide the token to a malicious application. The attacker can then easily authenticate through your library.
Given that OAuth is all about delegated authorization, meaning entity that uses the access token may not be the user but some third-party service using the token on behalf of the user, using it as proof-of-identity makes no sense.
This point becomes clearer with limited permissions. If access token is proof-of-identity, why limit what the user can do when you know it's the user?
In one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.
https://oauth.net/articles/authentication/
DO NOT USE THIS in its current state. Stop upvoting this.