Login Security - Facebook Login - Documentation - Facebook for Developers
Find out about the security steps that apps need to implement themselves.
The features of Facebook Login such as access tokens and permissions make it ... The API will behave as though no access token was provided. ... For apps with a limited number of redirect URIs, add each one to the Valid OAuth redirect URIs list. ... then Strict Mode won't allow www.example.com/token as a valid redirect.