I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks apply?

Or put another way, what could an attacker do if he stole a Facebook Connect secret key from a web application?

(edit: this is the token in question)

2 Answers 2


This depends on which key you are reffering to as the "secret key":

  • The application's secret key, or app secret, allows you to generate an application access token. With this access token, you have full access to the Graph API application object. An attacker who gets hold of your app secret could change all settings from your app dashboard. You should definitely not let this token leave your secured servers.

  • The access tokens that are granted to your users after authentication can allow an attacker to query the Graph API in the same way your app can. Facebook wouldn't know the difference. The possible impact of such an attack would depend on the permissions your app requires.


When an application is accessed using Facebook, an access token is associated with the user. This access token allows the app to have access level privilege to the user's profile. If this access token is stolen then it can be used to post contents onto the user's profile without his/her consent.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .