I'm testing a web app that has an option to connect to your facebook account. The oauth login flow starts like this:
I am not able to change the domain of the redirect_uri paramter, but I can change the "resource" part of the redirect_uri, so that I can point it to a page where I can insert an img tag with the src attribute pointing to my site, and by that steal the oauth code via the referer header.
But is the facebook oauth code of any use to me? I dont see a way to exchange it for an access token. The response_type=token is disabled.