I was looking through the Login with Facebook docs and was wondering what was stopping another app from spoofing my app's login. It seems like if someone reverse engineered my binary and got the appID I was passing to Facebook they could have their app make an identical request to Facebook and Facebook wouldn't be able to differentiate whether it was actually my app trying to sign in or another app.

What defenses does Facebook have against this? Is there something I should add to my app to help prevent against this

1 Answer 1


I believe you need also the App Secret to successfully issue a request. You should not store both hardcoded in your app. Based on your description it seams your app issues the request directly to fb server, which i think its not recommended instead you should have a server which work as intermediary and stores you app secret and app access token.

for more info checkout this page: https://developers.facebook.com/docs/facebook-login/security

  • Well so I considered that, but then I have an unauthed app communicating with my APIs to do the Login with Facebook and I wasn't sure how to prevent my APIs from responding to another app.
    – winhowes
    Commented May 3, 2017 at 22:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .