3 ms·
If access tokens were encrypted (which they are now) then this would have been avoided. That answers my question! (See https://news.ycombinator.com/item?id=661
by zaidf 13y ago
If access tokens were encrypted (which they are now) then this would have been avoided.
That answers my question! (See https://news.ycombinator.com/item?id=6619265 https://news.ycombinator.com/item?id=6619265)
Kudos for how you guys handled this during this tough few days.
- joelgascoigne 13y agoThat's right. In addition, Facebook has an 'appsecret_proof' method where you can require signing of all API calls with the app secret. We've now implemented this. Details: https://developers.facebook.com/docs/reference/api/securing-graph-api/#appsecret_proof https://developers.facebook.com/docs/reference/api/securing-... Thanks for the kind words :)