Go Back   CodingForums.com > :: Client side development > General web building

Before you post, read our: Rules & Posting Guidelines

Reply
 
Thread Tools Rate Thread
Enjoy an ad free experience by logging in. Not a member yet? Register.
Old 11-18-2012, 07:22 AM   PM User | #1
MarPlo
Regular Coder

 
Join Date: Mar 2011
Posts: 145
Thanks: 0
Thanked 20 Times in 20 Posts
MarPlo is an unknown quantity at this point
Login the user with Facebook without revealing the APP ID

Hi,
In the Facebook documentation about Login the user with Facebook APP they say:

"Because it requires you to include your App Secret you should not attempt to make this call client-side as that would expose this secret to all your app users. It is important that your App Secret is never shared with anyone".

I understend it is about APP Secret, but what about the Developer ID?
The developer ID is added in the URL address of the window for login the user with Facebook:
Code:
https://www.facebook.com/dialog/oauth?client_id=APP_ID&redirect_uri=...&state=...&scope=...
The APP_ID can be copied and used by anyone.
I tryed with JavaScript SDK, and with PHP SDK, but in both cases the developer ID appears in the address bar.
I tryed also the get and display the page from that URL address using cURL, but of course not works.
Is there any way to login the users in my web site using Facebook, without revealing the developer ID?
Or, it doesn't matter if someone uses your Facebook APP ID?
__________________
MarPlo is offline   Reply With Quote
Old 11-18-2012, 01:53 PM   PM User | #2
VIPStephan
The fat guy next door


 
VIPStephan's Avatar
 
Join Date: Jan 2006
Location: Halle (Saale), Germany
Posts: 7,587
Thanks: 5
Thanked 864 Times in 841 Posts
VIPStephan is a jewel in the roughVIPStephan is a jewel in the roughVIPStephan is a jewel in the rough
The app ID can’t be used by anyone else because it is linked to a certain user account. At least that’s what I would think. Even though Facebook isn’t the vanguard of privacy measures it would be pretty stupid if one could just use another person’s app ID.
__________________
Don’t click this link!
VIPStephan is offline   Reply With Quote
Old 11-19-2012, 04:56 AM   PM User | #3
kevin619
New Coder

 
Join Date: Apr 2011
Location: California
Posts: 37
Thanks: 0
Thanked 1 Time in 1 Post
kevin619 is an unknown quantity at this point
you could try using iframes? not a very good solution for the problem because it's still very much available but at least it's not in the address bar.
kevin619 is offline   Reply With Quote
Old 11-19-2012, 12:06 PM   PM User | #4
MarPlo
Regular Coder

 
Join Date: Mar 2011
Posts: 145
Thanks: 0
Thanked 20 Times in 20 Posts
MarPlo is an unknown quantity at this point
Thank you for the answer.
In the end I belive it doesn't matter because if FB made their APP to work in this way, they know how that ID can be used.
And I think it is the same ID that is already publicly.
__________________
MarPlo is offline   Reply With Quote
Reply

Bookmarks

Jump To Top of Thread


Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +1. The time now is 09:51 PM.


Advertisement
Log in to turn off these ads.