title: How does OAuth 2 protect against things like replay attacks using the Security Token?
body: <p>As I understand it, the following chain of events occurs in OAuth 2 in order for <code>Site-A</code> to access <strong>User's</strong> information from <code>Site-B</code>.</p>
  
  <ol>
  <li><code>Site-A</code> registers on <code>Site-B</code>, and obtains a Secret and an ID.</li>
  <li>When <strong>User</strong> tells <code>Site-A</code> to access <code>Site-B</code>, <strong>User</strong> is sent to <code>Site-B</code> where they tell <code>Site-B</code> that they would indeed like to give <code>Site-A</code> permissions to specific information.</li>
  <li><code>Site-B</code> redirects <strong>User</strong> back to <code>Site-A</code>, along with an Authorization Code.</li>
  <li><code>Site-A</code> then passes that Authorization Code along with its Secret back to <code>Site-B</code> in return for a Security Token. </li>
  <li><code>Site-A</code> then makes requests to <code>Site-B</code> on behalf of <strong>User</strong> by bundling the Security Token along with requests.</li>
  </ol>
  
  <p>How does all of this work in terms of security and encryption, on a high level? How does OAuth 2 protect against things like replay attacks using the Security Token?</p>