Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to the server where it is validated using the Graph API, something like this:
var url = "https://graph.facebook.com/debug_token?input_token=" + access_code + "&access_token=app_id|app_secret"
access_code comes from the client. Is it possible, that the client sends a fake token containing a redirection URL, exposing my secret key?