Question

From facebook graph api explorer https://developers.facebook.com/tools/explorer I generated a token, without asking any permission. By view the profile I actually see all education, work history, this is not right!

token permission:
{
  "data": [
    {
      "installed": 1,
      "type": "permissions"
    }
  ]
}

Did another test
1. remove my test app from facebook
2. connected to test app from my website without ask any permission
3. get the token
4. make graph api call /me
5. get a lot information I didn’t ask, e.g. education, work history, email, hometown…

test the token permission, it only show

{
  "data": [
    {
      "installed": 1,
      "type": "permissions"
    }
  ]
}

any idea?

Answer 1

Maybe calling https://graph.facebook.com/user_id_OR_username would not only retrieve basic information but all your info set to public in the privacy settings.

P.S.: read question comments.