Is it safe to have facebook App ID embedded in the UI javascript code?

Question

Facebook's documentation says that we can initialise FB in our app by running the following code. The code is from the documentation but this also expects 'appId' to be passed as parameter.

Question: Is it really secure to have the 'appId' embedded in a single page application's client side Javascript code or should this be handled on the server side somehow ?

FB.init({
    appId      : '{your-app-id}',
    status     : true,
    xfbml      : true,
    version    : 'v2.4' // or v2.0, v2.1, v2.2, v2.3
  });

Update: As @KK pointed out the documentation says app-secret. So I'm guessing it's safe to have app-id in the browser but I should keep the app-secret safe. When I check my facebook dashboard I can see I have two different ids for app-id and app-secret.

Even if I kept app-id on the server and redirected the user via the server, the app-id will still be visible to the user because the documentation here says that the redirect url is a GET request so all the parameters are visible anyway.

Answer 1

The App ID is perfectly safe to publish (it will be visible in the login process anyway), the App Secret on the other hand is called "Secret" for a reason. With App ID and App Secret, you would already have an App Access Token (App-ID|App-Secret). With an App Access Token, you would be able to change some App settings: https://developers.facebook.com/docs/graph-api/reference/application#Updating

To improve security, you should activate "Require App Secret" in the App settings and use appsecret_proof for server calls:

• Settings: https://developers.facebook.com/apps/[app-id]/settings/advanced/
• Securing API calls: https://developers.facebook.com/docs/graph-api/securing-requests
• General information: https://developers.facebook.com/docs/facebook-login/security