OAuth2是否通过http标头验证请求域？

Question

I am currently learning about OAuth2, and I am slightly confused about one part of it. Does the OAuth2 server compare the domain in the JWT with the domain in the request header?

What prevents someone from ripping a bearer token out of a JS app and then using it to make fraudulent API requests? Even if HTTPS is used, the token sent back from OAuth2 still has to be stored before it can be used in subsequent requests, thus making it vulnerable. What am I missing?

Edit: what if I create an oauth2 token from a non-browser client and there is no domain name to match against?

Answer 1

Nothing prevents it from being used. That's why you store it safely or you don't store it at all.