title: Facebook Oauth Code Flow
body: <p><a href="https://developers.facebook.com/docs/facebook-login/security/" rel="noreferrer">https://developers.facebook.com/docs/facebook-login/security/</a></p>
  
  <p>On this page, there is a video that talks about security issues related to Facebook login. Around 13 minutes, he talks about oauth code flow. The idea is that if you're only making requests from the server, you should generate a code that you can then trade for an access token on the server.</p>
  
  <p>To do this, you set response_type to code in the query params.</p>
  
  <p><a href="https://i.stack.imgur.com/UnnGQ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/UnnGQ.png" alt="response_type code"></a></p>
  
  <p>My question is how do you do that with the SDKs? The video suggests that you need to set Client Oath Login to false in the settings:</p>
  
  <p><a href="https://i.stack.imgur.com/MxNor.png" rel="noreferrer"><img src="https://i.stack.imgur.com/MxNor.png" alt="settings"></a></p>
  
  <p>I did that, but I can see in the Chrome network tab that the SDK is still setting response_type to token. The result is this error:</p>
  
  <p><a href="https://i.stack.imgur.com/W4uRa.png" rel="noreferrer"><img src="https://i.stack.imgur.com/W4uRa.png" alt="error"></a></p>
  
  <p>What am I missing?</p>
  
  <p>TL;DR I want to use the Facebook login dialog to get an access code that I can trade for an access token on the server.</p>