https://developers.facebook.com/docs/facebook-login/security/
There is a video on this page that talks about security issues associated with logging into Facebook. After about 13 minutes, he talks about the oauth code stream. The idea is that if you only make requests from the server, you must generate code that can then be exchanged for an access token on the server.
To do this, you set the response_type parameter to the code in the request parameters.
My question is: how do you do this with the SDK? The video assumes that you need to set the “Client Identification” parameter to “false” in the settings:
I did this, but on the Chrome network tab, I can see that the SDK is still setting response_type to token. The result is this error:
What am I missing?
TL DR I want to use the Facebook login dialog to get an access code that I can exchange for an access token on the server.
source share