Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I came across this particular app which is spreading virally among many Malaysian Facebook users:


The app is asking users to copy paste a so called Sony Xperia Mobile token into their app. Apparently the supposed mobile token is actually the users’ Facebook access token created for that particular Sony Xperia app.

What are the repercussions of sharing the Facebook access token with the app this way?

share|improve this question
up vote 3 down vote accepted

You open yourself to access you most likely don't want to give. An access token is a way for a user to state that they are giving limited access for an application to see data.

Copy pasting the access_token means that you bypass the OAuth flow that prevents any hijacks of your account.

The access_token is in plain sight because the redirect_uri is set to http://facebook.com which doesn't handle the response.

As the User access token is passed to your redirect_uri in the URL fragment, it therefore must be retrieved using some type of Javascript - this depends on the Javascript framework you want to use, some examples include querystring.parse in Node.js or jQuery BBQ.


Gives the intruder (https://www.facebook.com/SpritzNetworks) access to the following

  • publish_stream
  • offline_access
  • user_photos
  • friends_photos
  • publish_actions
  • read_stream
  • email
  • user_status
  • user_activities
  • user_likes

Many shady pages, use Xperia app as a way to coax users into giving their access token

Summary: Don't give out your access_token, you aren't even supposed to know it exists in the first place.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.