4 ms·
what provider? Facebook never sends it in query string. It can also be available for Man In The Middle, in server side logs etc. Hash is supposed to be more sec
by homakov 14y ago
what provider? Facebook never sends it in query string. It can also be available for Man In The Middle, in server side logs etc. Hash is supposed to be more secure.
- johns 14y agoFB definitely sends access token via URL param for the server side flow: https://developers.facebook.com/docs/howtos/login/server-side-login/ https://developers.facebook.com/docs/howtos/login/server-sid... If there were a mitm they could get it even if it's in the hash. It has to travel to the client at some point.
- homakov 14y agoif it's in hash it can be seen only from FB response (https). redirect_uri can be http so hash is not transferred of course it's visible in server-2-server, but not client-server