Take the 2-minute tour ×
Stack Overflow is a question and answer site for professional and enthusiast programmers. It's 100% free, no registration required.

Moving question from CodePlex to Stackoverflow where this really belongs.

I see that facebook generates an AppId and an AppSecret. In the sample provided, AppId is baked into the code however there is no mention of using AppSecret. Shouldn't it be specified some where in the code to sign requests? What am I missing?

Thanks,

WP7Noob

Response from DevTheo

The way we are getting the Access Token gets around needing the secret. Once you have an access token, you can pretty much do everything you need to do. You can, of course, add it to the creation of the FacebookApp (but I'm pretty sure with the way we are doing things you don't need the secret).

Jay

share|improve this question

1 Answer 1

We don't use the app secret in the WP7 authentication process because we don't think it is best practice to put the secret with your app. You should only use the app secret on your server where it is secure. I am not sure why the iOS or Android SDKs use them because that is really against Facebook's own best practices. (And yes, I realize the irony of Facebook breaking their own guidelines, but they do it all the time).

Additionally, the way that OAuth works on a WAP device (as DevTheo pointed out) we dont need the secret to get the access token.

This being said, you are correct that you can't verify the authenticity of the token when you receive it. But that really isn't a problem. If somebody spoofs a token, it wont work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["        <li><a href=\"http://area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"http://careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.7.30.1735\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Stack Overflow works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </nos"], "copyright__copyright__copyright": [" works on a WAP device (as DevTheo pointed out) we dont need the secret to get the access token.\n\nThis being said, you are correct that you can't verify the authenticity of the token when you receive it. But that really isn't a problem. If somebody spoofs a token, it wont work.\n\nshare|improve this answer\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}