I wrote a blogpost about webanalytics and authentication. https://www.mathieupassenaud.fr/webanalytics_enemy/ Using "authorization code grant" is not as secure as we imagine with those kind of analytics