Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to the server where it is validated using the Graph API, something like this:

 var url = "https://graph.facebook.com/debug_token?input_token=" + access_code + "&access_token=app_id|app_secret"

access_code comes from the client. Is it possible, that the client sends a fake token containing a redirection URL, exposing my secret key?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.