3 ms·

FB definitely sends access token via URL param for the server side flow: https://developers.facebook.com/docs/howtos/login/server-side-login/ https://developers

by johns 14y ago

FB definitely sends access token via URL param for the server side flow: https://developers.facebook.com/docs/howtos/login/server-side-login/ https://developers.facebook.com/docs/howtos/login/server-sid... If there were a mitm they could get it even if it's in the hash. It has to travel to the client at some point.

homakov 14y ago
if it's in hash it can be seen only from FB response (https). redirect_uri can be http so hash is not transferred of course it's visible in server-2-server, but not client-server