Stealing Facebook oAuth code (not token) of no use?

Question

I'm testing a web app that has an option to connect to your facebook account. The oauth login flow starts like this:

https://www.facebook.com/v2.7/dialog/oauth?client_id=xxx&redirect_uri=https://comapny.com/part_of_url_that_i_can_change&response_type=code&scope=manage_pages

I am not able to change the domain of the redirect_uri paramter, but I can change the "resource" part of the redirect_uri, so that I can point it to a page where I can insert an img tag with the src attribute pointing to my site, and by that steal the oauth code via the referer header.

But is the facebook oauth code of any use to me? I dont see a way to exchange it for an access token. The response_type=token is disabled.

Answer 1

A code is exchanged for a token, by way of an authenticated call by the receiving application. That means the receiving application has a client ID and secret that it uses to authenticate itself before it can get a token on behalf of the user.

In this particular case, it's all a matter of whether you can get access to the client ID and secret. You can't do anything without them, so the code is effectively useless.

There's a scenario (IOW vulnerability) where any code can be used with any client ID/secret, so you could use the code if you created your own, but this isn't particularly common and I've no doubt Facebook already accounts for this.