I'm working to add FB sign-in to my website. In the process, I thought I might as well write a quick helper for OAuth 2.0 handshakes in general.
In reading the OAuth RFC
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-25#page-7
FB appears not to adhere to the standard. For example;
In 3.3. the scope should be a space-delimited list, but FB wants a comma-delimited.
In 4.1.1. Authorization Request, FB don't care for the required response_type parameter.
In 4.1.3. Access Token Request, FB don't care for the required grant_type parameter, but more interestingly, the RFC wants the parameters sent up in the body.
And in 4.1.4. Access Token Response, the entire format of the payload is different.
Am I right??
The version of OAuth linked to from the Facebook site, 2.12, also varies from FB's documentation of the flow in the above ways.
Note that 4.1.3. in 2.12 requires the client ID and secret to be passed up in the token request, whereas this requirement is gone in version 2.25.