title: Vulnerability with Facebook token hijacking
body: <p>According to Facebook manual for developers (<a href="https://developers.facebook.com/docs/facebook-login/security" rel="noreferrer">https://developers.facebook.com/docs/facebook-login/security</a>) you don't have to use <code>access_token</code> from some sort of Facebook SDK clients without ensuring that it was generated specifically for your Facebook application.</p>
  
  <p>I'm wondering what kind of vulnerabilities has place here. Why I should care about which app received token if I can use it to make API calls and get user data through it?</p>
  
  <blockquote>
    <p><strong>Token Hijacking</strong></p>
    
    <p>To understand how this happens, imagine a native iOS app that wants to make API calls, but instead of doing it directly, communicates with a server owned by the same app and passes that server a token generated using the iOS SDK. The server would then use the token to make API calls.</p>
    
    <p>The endpoint that the server uses to receive the token could be compromised and others could pass access tokens for completely different apps to it. This would be obviously insecure, but there is a way to protect against this - access tokens should never be assumed to be from the app that is using them, instead they should be checked using debugging endpoints.</p>
  </blockquote>