title: Proper way to ship facebook token from client to server
body: <p>I'm not sure how to ship a user's fb token from his client to my server. My current approach is the following:</p>
  
  <ol>
  <li>User opens webpage and logs in to FB;</li>
  <li>Token is obtained from FB;</li>
  <li>Redirect user client to /api/:token</li>
  <li>Use express + node + <code>app.get("/api/:token")</code> to obtain the token on the server</li>
  </ol>
  
  <p>However, this doesn't look safe, since when I redirect the user his token is clearly visible on the browser, and anyone could try to guess a token to impersonate some other user.</p>
  
  <p>Question: how do I safely ship a user's fb token from the client to my server? should I use an ajax post?</p>
  
  <p>Thank you for helping! :D</p>