title: Facebook OAuth and redirect URI
body: <p>Looking at Google OpenId connect and Facebook login I noticed that Facebook always hits the "redirect URI" from the browser. To explain a bit more - when user follows link of the form </p>
  
  <pre><code>https://www.facebook.com/dialog/oauth?client_id={app-id}&amp;redirect_uri={redirect-uri}
  </code></pre>
  
  <p>S/he is always redirected to the URL specified by {redirect-uri}. This URL then contains "code" which can be exchanged for access token.</p>
  
  <p>Google has similar approach but when using "server-flow" the {redirect-uri} is "hit" by Google's servers. This way the code which needs to be exchanged for access token never gets shown to the user.</p>
  
  <p>It seems like FB's approach is less secure as the access code can actually end up in the attacker's hands.</p>
  
  <ol>
  <li>Is there a way to have FB send the code to a redirect URI but not actually redirect client? Something like what Google does. </li>
  <li>Does anyone have a good explanation why FB does not have "server-flow"-like behaviour but only "implicit-flow"?</li>
  </ol>