CODEWITHSUNDEEP
oauth-2.0facebook-oauthfacebook-access-token
Ken Mazaika
Ken Mazaika

Reputation: 1142

Sharing Facebook Access Tokens Across Apps

I want to provide a service using the facebook api to third parties. Is it possible for us to share access tokens? If the third party gives my service a user's access token, can I access that users data even if my app_id & secret do not match the app that requested it?

Should I have the users go through a separate oauth flow on my site even if they have already completed it for the other third party?

Thanks.

-ken

Upvotes: 2

Views: 7555

Answers (3)

Eugene Fidelin
Eugene Fidelin

Reputation: 2319

Even that user access token is issued only for one app it can be easily used from any other application.

Example:

  1. Get access token for "Graph API Explorer" application here https://developers.facebook.com/tools/explorer/?method=GET&path=me and make a request - you will see your data.
  2. Copy access token and open other machine|browser and go to https://graph.facebook.com/me?access_token=[access_token] - you still able to retrieve information about your Facebook user!

Here https://developers.facebook.com/docs/concepts/login/access-tokens-and-types/ it mentioned that

Our Data Policies explicitly prohibit any sharing of an Access Token for your app with any other app. However, we do allow developers to share Tokens between a native implementation and a server implementation of the same App (ie. using the same App ID) as long as the transfer takes place using HTTPS.

Upvotes: 10

Antonio Saco
Antonio Saco

Reputation: 1650

Regarding:

Is it possible for us to share access tokens?

and,

can I access that users data even if my app_id & secret do not match the app that requested it?

The answer is No. From the specs OAuth2 section 10.3:

Access token credentials (as well as any confidential access token attributes) MUST be kept confidential in transit and storage, and only shared among the authorization server, the resource servers the access token is valid for, and the client to whom the access token is issued.

Should I have the users go through a separate oauth flow on my site even if they have already completed it for the other third party?

The answer is Yes. If you're using facebook as authorization server, and you restart the oauth flow again, your user will only need to approve your other app (third party).

Upvotes: 5

Claudiu
Claudiu

Reputation: 3261

Each access token is issued only for one app - it cannot be used with different application IDs.

Upvotes: 4

Related Questions