When making a FB.ui apprequest I can’t help but think that a user could do something like, install Firebug, place a breakpoint on the FB.ui call and alter the contents of the request message. Altering the contents of the message itself I don’t really worry about but they would still have access to the data field. Is there a recommended approach to protecting the data field (some sort of encryption perhaps?) and requests in general? Thanks.
When making a FB.ui apprequest I can’t help but think that a user could
Share
Firebug and other intermediaries will always bypass such security features, and there’s no true encryption that’s purely client side, only obfuscation. It sounds like you are thinking about your application secret keys? Typically a client-side app shouldn’t contain that, rather you have an intermediate server that receives app requests, passes them on to Facebook, and returns the results to the client.