While checking the facebook php sdk implementation I noticed that they expose the access token to the resource owner (user)

$params = array(
  'next' => $next,
  'access_token' => $session->getToken()
return 'https://www.facebook.com/logout.php?' . http_build_query($params, null, '&');


How harmful is it considered to be? I cannot explain it, but it just does not look right.

In case it's not "the best practice" how would one implement a logout using oauth v2 flow instead?

I have made some research in the specification and that's what I've found:

Don't pass bearer tokens in page URLs: Bearer tokens SHOULD NOT be passed in page URLs (for example, as query string parameters).



It is true that bearer tokens and session tokens should not be passed int he url. The reasons are (according to OWASP):

might disclose the session ID (in web links and logs, web browser history and bookmarks, the Referer header or search engines)

In this specific case, I think Facebook did not care since the usage is logout - so after it has been called the token is not usable anymore any way, so no big deal if it is leaked.

| improve this answer | |
  • "so after it has been called the token is not usable anymore" --- if only the logout process succeeded. – zerkms May 11 '15 at 21:18
  • @zerkms you are right... I really don't understand why not stick to the safe behavior of not including the token in the URL also for the logout. I guess they wanted to simplify the logout action, or had it like this in legacy code... – aviv May 12 '15 at 8:18
  • Yep, the specification friendly and safe solution would require additional state: the temporary logout token. Which I suppose would be painful for a distributed system of a FB size – zerkms May 12 '15 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.