0

I'm working to add FB sign-in to my website. In the process, I thought I might as well write a quick helper for OAuth 2.0 handshakes in general.

In reading the OAuth RFC

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-25#page-7

FB appears not to adhere to the standard. For example;

  • In 3.3. the scope should be a space-delimited list, but FB wants a comma-delimited.

  • In 4.1.1. Authorization Request, FB don't care for the required response_type parameter.

  • In 4.1.3. Access Token Request, FB don't care for the required grant_type parameter, but more interestingly, the RFC wants the parameters sent up in the body.

  • And in 4.1.4. Access Token Response, the entire format of the payload is different.

Am I right??

The version of OAuth linked to from the Facebook site, 2.12, also varies from FB's documentation of the flow in the above ways.

Note that 4.1.3. in 2.12 requires the client ID and secret to be passed up in the token request, whereas this requirement is gone in version 2.25.

1
  • So what's the actual question? This looks more like a whinge, rather than an actual question May 15, 2012 at 21:23

1 Answer 1

0

So the answer is that Facebook doesn't use OAuth.

Facebook uses its own pretend OAuth. If you write an OAuth library based on the specification, it will not work for Facebook.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.