<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Yes it is. <div><br></div><div><span class="Apple-style-span">Reading the FB documents I assumed that </span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(0, 96, 0); font-family: monospace; font-size: 13px; line-height: 18px; ">oauth_token</span><span class="Apple-style-span"> in the signed request is the access token for the graph API.</span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span">Breno reports conversations with FB's developers that indicate that is not the current practice.</span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span">One reason why that would be a bad idea is that it would allow access tokens to be sniffed for non SSL RP. Not a problem for the RP, but perhaps a large one for the IdP.</span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span">Having an attacker get a id_token or session cookie is less problematic than if they get a long term access token. If the id_token is set as a cookie then including the access token is a bad idea.<br><div><div>On 2011-08-25, at 12:55 PM, Allen Tom wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">My understanding of FB's implementation is that their equivalent of the id_token actually contains the access_token, rather than a hash of the access_token or code.<div><br></div><div>Is the FB signed_request the equivalent of the id_token?</div>
<div><br></div><div><a href="https://developers.facebook.com/docs/authentication/signed_request/">https://developers.facebook.com/docs/authentication/signed_request/</a></div><div><br></div><div>Allen</div><div><br></div>
<div><br><br><div class="gmail_quote">2011/8/25 John Bradley <span dir="ltr"><<a href="mailto:ve7jtb@ve7jtb.com">ve7jtb@ve7jtb.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
<br>
Facebook is currently doing something like this with there signed request tokens where they are including code in the token, or a hash of the access token.<br>
Facebook's implementation is not completely based on OAuth 2 draft 10. It is a bit hard to figure it out from the documentation.<br>
<br><br></blockquote></div><br></div>
</blockquote></div><br></span></div><div></div><div></div><div></div><div></div><div></div><div></div><div></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div><span class="Apple-style-span"><br></span></div><div></div></body></html>