This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible.
Let's say I'm using Facebook login in my app. If the login is successful I get I get back an OAuth token from Facebook to make API requests. Now Facebook has also this token and could use this to log in to my app and fetch all the data inside this app. I'm not sure if this is possible, but this could be a security concern.
Many thanks!
To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please.
Given that, there are three potentially correct answers here.
This is not a threat, because it's outside of your threat model, or an negligible risk. In most cases this is going to be the correct answer. It's outside of your threat model, because you're assuming that Facebook is correctly authenticating people and if you get an OAuth token from them, it's for the authenticated user they say it's for. It's a negligible risk because it's unlikely Facebook cares about your application data, and it's unlikely that even if they do, they're willing to abuse a system they've spent a large amount of money to build and operate, and that is popular only because it's trusted. That would defeat their larger and more valuable goal of getting their fingers in every corner of the web.
It is a threat, and can be mitigated with a second authentication factor. If this is a serious enough risk to your application for whatever reason, you can mitigate it for existing users of your app by requiring a second authentication factor that Facebook doesn't have control over, so that you're not relying solely on the OAuth token.
If it is a serious threat, don't use Facebook OAuth at all. If you really don't trust them, then don't use their system. Simple as that. If the data in your application is so sensitive that it warrants requiring uses to create a new set of credentials, make them do that.
All of that said, the vast, vast majority of cases are going to fall under scenario 1. First, when you choose to use Facebook OAuth, you're doing it so that you don't need to worry about authentication, and threats to authentication (for the most part) become external. Additionally, the thought that Facebook would abuse the system to harm you or your users is more of a fictional plot than a real threat, and the actually likelihood of that occurring is generally negligible, and not worth the cost, effort, and complexity of mitigating.
