title: Client-side JavaScript Facebook OAuth2 implementation?
body: <p><strong><a href="https://www.rfc-editor.org/rfc/rfc2617" rel="nofollow noreferrer">RFC 2617</a></strong> specifies the <em>HTTP Basic and Digest Auth</em> standard and works as summarised in <a href="http://en.wikipedia.org/wiki/Digest_access_authentication#Example_with_explanation" rel="nofollow noreferrer">Wikipedia's &quot;Example with explanation&quot; subsection</a>:</p>
  <blockquote>
  <ul>
  <li>The client asks for a page that requires authentication but does not provide a username and password. Typically this is because the user simply entered the address or followed a link to the page.</li>
  <li>The server responds with the 401 &quot;client-error&quot; response code, providing the authentication realm and a randomly-generated, single-use value called a nonce.</li>
  <li>At this point, the browser will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a username and password. The user may decide to cancel at this point.</li>
  <li>Once a username and password have been supplied, the client re-sends the same request but adds an authentication header that includes the response code.</li>
  <li>In this example, the server accepts the authentication and the page is returned. If the username is invalid and/or the password is incorrect, the server might return the &quot;401&quot; response code and the client would prompt the user again.</li>
  </ul>
  <p>Note: A client may already have the required username and password without needing to prompt the user, e.g. if they have previously been stored by a web browser.</p>
  </blockquote>
  <p>I am performing login using <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-29" rel="nofollow noreferrer">OAuth2 draft-standard</a> as implemented by <a href="https://developers.facebook.com/docs/authentication/server-side/" rel="nofollow noreferrer">Facebook</a>.</p>
  <p><strong>Given a server with an exposed public API (e.g.: JSONRPC or REST), how could the client-side JavaScript frontend be written to include the sort of functionality as the previously mentioned RFC 2617 example, but for Facebook auth?</strong></p>