I am trying to embed facebook auth into my application. My initial effort was to login in browser and obtain code. I pass this code back to my api and obtain access token (that stays with the server) and route all my requests to FB Api through my server. Seemed totally secure to me as my client has no information to be able to make authorized calls to FB as my app.

I however have been looking at FB Javascript SDK to avoid writing code for dialog opening and closing and noticed that it allows me to getLoginStatus and returns me the access token. Also, I went over FB auth flows in their documentation and they say that client-server hybrid flow is okay to do where server actually gives "Long lived access token" back to the client and advises me to use HTTPS (fair).

Now all this gets me thinking if this is a security concern. Can't I as a potential hacker inject some javascript into the user's webpage that could either
a) make a getLoginStatus and get the access token or
b) just get the access token by making a request to my api server and get the access token
and then use that to post (assuming that user authorized my app to do so) to facebook as if my app was doing it?

I am a security newbie and maybe overlooking a bunch of stuff here but could someone help me understand what I'm missing?

Thanks in advance!

PS: I do know I can enable further security to ensure that I need the app secret every time I want to make a request which the client can't do as that information will never be available on client side.

1 Answer 1


I think the key here is that the access token returned client side is very short lived (10min). In that sense, I think session hijacking could be possible but then gives limited risk, similar to the normal session risk mitigation procedures for many auth systems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .