## The problem
Issue NangoHQ/nango#582 (closed, 6 comments): Raised by this community [message](https://nango-community.slack.com/archives/C04ABR352H0/p1682327350087349) (and a couple other ones before). We should have a mechanism to verify the connection ID to avoid malicious attempts to store credentials for another user in the application.

## What fixed it
[bastienbeurier (member)]: To stop attackers spoofing user accounts during OAuth, Nango added HMAC verification. Set NANGO_HMAC_REQUIRED=true, NANGO_HMAC_ALGORITHM=sha256, and NANGO_HMAC_KEY to a secret server-side, then pass the digest in nango.auth with an hmac option. Resolved by PR #591.