CODEWITHSUNDEEP
facebook
Eyad Fallatah
Eyad Fallatah

Reputation: 1948

Is it safe to share Facebook API id and secret key?

I am working on an open source web-based application that communicates with Facebook. One of the files contains the Facebook API id and secret key. Is it fine to share this information with the rest of the world?

Upvotes: 5

Views: 4061

Answers (4)

James Anderson
James Anderson

Reputation: 163

It is not safe to share the secret key, you shouldn't share this with anyone. When you open source the code put in some dummy values instead, or nothing at all.

Upvotes: 4

Matthew Johnston
Matthew Johnston

Reputation: 4439

It is extremely important that you never share your app secret. Your app ID is completely unimportant and available to anyone who goes to your Facebook apps profile page, but the app secret is a completely different story. It could compromise any data stored within your application and allow third parties to call specific APIs on your behalf without your knowledge. This is bad for you and for your users.

If you have accidentally shared your app secret (this can happen when it's embedded in client binaries or code) then you can reset it really quickly through the Facebook developer app: https://developers.facebook.com/apps goto Settings -> Edit and then click reset beside the app secret. This will have the effect of invalidating any access tokens that have been previously been granted by your app.

Upvotes: 12

genesis
genesis

Reputation: 50976

No it isn't. Why do you think they named it "Secret" ?

It's the truth that there is probably no way to abuse it (because Facebook always checks origin URL, too) however you should not share it...

Upvotes: 3

Brian Hoover
Brian Hoover

Reputation: 7991

The secret key, is, well secret. You shouldn't share it with anyone.

Upvotes: 0

Related Questions