KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
In order to obtain an access_token from Facebook, you have to transmit your app_id , the code you receive after the authorize request, and your app's secret_key . Why would I EVER transmit my secret key? This seems blatantly insecure. Is this a requirement of the OAuth 2.0 spec? As a related question, why would I need to transmit an app_id when my request is already signed with my consumer_key ? I've got a working app, I just don't understand these requirements.
Tags (comma-separated)
Save Edits
Cancel