3 ms·
Because I guess in this "flow", you do not actually supply the information to Facebook for them to verify that claim. From the article: > In steps 6-7: > rando
by locallost 3y ago
Because I guess in this "flow", you do not actually supply the information to Facebook for them to verify that claim. From the article:
> In steps 6-7:
> randomsite.com reads the token from the URL and uses it to talk directly with Facebook using the following API:
> https://graph.facebook.com/me?fields=id,name,email&access_token=[secret_token] https://graph.facebook.com/me?fields=id,name,email&access_to....
> The response is john@gmail.com.
So you send the token only and the token is valid, and there's no way for Facebook to check if it was meant for you or not. As mentioned in other posts, this would not happen in other flows because you would send e.g. your client secret along with the code.
- fulafel 3y agoThe question still is, are Facebook failing to associate the token with the application context that requested it?
- locallost 3y agoFailing sounds like its a requirement for them to do it, but this is not true. If you send them just a token, then how would they associate it with the application? Like I said, in another flow where you send your client secret and a code to exchange for the token, they need to verify it and it would be a failure on their part if they didn't.
- fulafel 3y agoThey have the client id when the token is requested, so they can associate the generated token with it by either keeping some state or encoding it in the token, no?