Facebook and appsecret_proof

[jojo.serquina]

I was searching the forum to see if there's anyone having the same issue we have with Facebook as IP with "Require App Secret" turned on. Basically, when we call /api/identity-provider/login and we provide the accesstoken our application received from Facebook authentication, FusionAuth does not send the appsecret_proof with the request, therefore the request fails.

Any workarounds? (other than turning the setting off)

Thanks!
Jojo

[dan]

@jojo-serquina

I don't believe there's a way to provide appsecret_proof currently, but it looks like it'd be a great enhancement. ( https://developers.facebook.com/docs/graph-api/security has more details about appsecret_proof for anyone else reading.)

Can you please file an issue here: https://github.com/fusionauth/fusionauth-issues/issues detailing how you'd like to be able to provide this additional parameter to improve your application's login security?

Thanks.

[jojo.serquina]

@dan Thank you for the additional information. It definitely would allow for additional security. I will file an issue shorlty.

[dan]

@jojo-serquina Thanks!

For any future readers, you can see the state of this feature request here: https://github.com/FusionAuth/fusionauth-issues/issues/1536