Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks apply?

Or put another way, what could an attacker do if he stole a Facebook Connect secret key from a web application?

(edit: this is the token in question)

share|improve this question

This depends on which key you are reffering to as the "secret key":

  • The application's secret key, or app secret, allows you to generate an application access token. With this access token, you have full access to the Graph API application object. An attacker who gets hold of your app secret could change all settings from your app dashboard. You should definitely not let this token leave your secured servers.

  • The access tokens that are granted to your users after authentication can allow an attacker to query the Graph API in the same way your app can. Facebook wouldn't know the difference. The possible impact of such an attack would depend on the permissions your app requires.

share|improve this answer
Neither of these tokens Mr 1, this is the token I'm interested in: (…) – rook Nov 4 '13 at 15:50

When an application is accessed using Facebook, an access token is associated with the user. This access token allows the app to have access level privilege to the user's profile. If this access token is stolen then it can be used to post contents onto the user's profile without his/her consent.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.