App Secret should not be distributed about phonegap-facebook-plugin HOT 4 CLOSED

Atimb, you are using your App Secret in your aplication files, even in the facebook samples, the App Secret is on the code, below is a fragment of PHP SDK:

require_once("facebook.php");

$config = array();
$config[‘appId’] = 'YOUR_APP_ID';
$config[‘secret’] = 'YOUR_APP_SECRET';
$config[‘fileUpload’] = false; // optional

$facebook = new Facebook($config);

I think is not a big problem use the app secret in the android manifest, maybe I'm wrong.

from phonegap-facebook-plugin.

Thanks for your answer, however the big difference here is that this PHP file is residing on your server, and (unless hacking your server) no one can ever access it. On the other hand, the android manifest is simply packaged into your android package (APK) that your users will download from the store. It's content can be simply read by anyone.

from phonegap-facebook-plugin.

I didn't know about this possibility, but I'm seeing the ConnectPlugin.java seems easy insert the appSecret there instead of puting in AndroidManifest.xml, if we put the key in there, the problem is solved?

I'm not sure, but is just for me or the app works fine, whatever App Secret we use?

from phonegap-facebook-plugin.

@atimb I agree, the app secret shouldn't be included anywhere in the apk file people download, as that would allow them to impersonate your application which could be a bit of a security risk.

Normally for the Javascript SDK on the web you only need the Application ID and not the secret - the operations requiring the secret have to be done server side. I wonder why this SDK would need the secret ?

from phonegap-facebook-plugin.