How to safely use vk.com oauth widget?

Question

Django

I want to use the oauth widget on the site for authorization through VKontakte. The widget is provided by vk.com itself. After the user confirms access, he is redirected to my site with get parameters: uid, firstname, lastname, photo_url, hash. URL looks like this

koi.pythonanywhere.com/dev/Login?uid=77754028&firs...

After checking authorization by hash, I successfully register or login user. But what if someone gets access to the user's device and copies this url in the browser's history? It turns out that he will be able to log in as user N everywhere and from any device? If so, how can this be prevented? For example, Google aouth also returns the time parameter, which apparently serves to prevent such incidents from happening. But what if vk.com doesn't return anything like that?

Answer 1

Judging by the documentation (I doubt that the off widget uses other requests), the code goes bad after 1 hour.

Answer 2

Solution: immediately redirect to another page of the site so that the address is not saved in the history