4 ms·
We were told that third parties can't get any information from the social plugins. The data is served directly from Facebook using an iframe.
by jkincaid 16y ago
We were told that third parties can't get any information from the social plugins. The data is served directly from Facebook using an iframe.
- aphyr 16y agoAh, so CNN is handing its template and some fb query off to the plugin for display, then?
- cemregr 16y agoExactly. http://developers.facebook.com/docs/reference/plugins/like http://developers.facebook.com/docs/reference/plugins/like
- banjiewen 16y agoThat's true for the social plugins, but if you've authenticated with the site (e.g., click the "log in" button at the top of any CNN page and log in with FB), any 3rd party running javascript on the page will have access to all of the data you've allowed the parent site to access. Facebook uses their parent-child-parent iframe tricks to assign a first-party cookie for the host domain. This cookie contains the Facebook user id and the OAuth access token used to make requests to the Graph API. Any javascript running on the page can snatch that cookie and send the data back up to its mothership, which can then impersonate the host domain to make API requests on behalf of the user. Fun stuff.