title: Facebook login autumatically adds "user_friends" permission to request
body: <p>I'm currently building my own login workflow as described in <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/" rel="nofollow">https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/</a>.</p>
  
  <p>Everything works like a charm but one tiny thing: At the moment my site redirects the user to Facebook with the <code>scope</code> parameter set to only <code>email</code>.</p>
  
  <p>But then the user is asked to grant access not only to their public profile and their email but also to their friend list. When accepted and sent back to my site the <code>scope</code> parameter now also reads <code>email, user_friends</code>.</p>
  
  <p>Is there a reason why this happens and is there a way to prevent this for the moment?</p>