How to use Facebook token obtained through Firebase authentication appropriately?

Question

I am trying to get a person's first name and last name when the person would like to sign up through Facebook, but wondering if there can be some security issue.

Based on the document from Firebase, the answer from Stack Overflow, and the explanation about parameters from Facebook website, I wrote the following codes:

firebase.auth().getRedirectResult().then(function(result) {
   var token = result.credential.accessToken;
   FB.api('/me', {fields: 'last_name', access_token: token}, function(response) {
   console.log(response);
   })
})

My main concern is that according to Facebook, it says:

One parameter of note is access_token which you can use to make an API call with a Page access token. App access tokens should never be used in this SDK as it is client-side, and your app secret would be exposed."

It looks like I cannot use this approach to get a user's first and last name.

Answer 1

Starting with Firebase 4.0.0, additional IdP data will be directly returned in the result of type UserCredential. You shouldn't need to make an additional API call to Facebook to get data like first/last name:

firebase.auth().getRedirectResult().then(function(result) {
  if (result.user) {
   // Additional user info like first name, last name,
   // Facebook account url, gender, etc.
   console.log(result.additionalUserInfo.profile);
   // Facebook access token returned in the process
   // for the scopes requested.
   console.log(result.credential.accessToken);
 }

});