As an added security measure Facebook API calls can specify the appsecret_proof (see
https://developers.facebook.com/docs/graph-api/securing-requests/). There is an advanced option in the Facebook app settings that requires all API calls using the app id to specify
the appsecret_proof parameter.
The Microsoft.Owin.Security.Facebook implementation does not specify this parameter, so if you set the "Require AppSecret Proof for Server API calls" option, authentication requests will fail with an access denied error.
Does anyone know if/how the Microsoft.Owin.Security.Facebook implementation can be extended to add this parameter. It seems to be in the FacebookAuthenticationMiddleware and FacebookAuthenticationHandler classes?
Go to the complete details ...