使用FBSDKLoginManager for IOS的​​安全问题

Question

According to Facebook docs, Facebook login for IOS provide "FBSDKLoginManager" - which directly call into the API to perform login or additional authorizations with your own UI. https://developers.facebook.com/docs/facebook-login/ios#login-apicalls

If an application uses its own login UI, it can potentially steals user credentials typed into it. That seems violates the purpose of OAuth2.0/OpenID to make authentication mechanisms and credentials independent from the client/app.

I'm wondering why there is a "FBSDKLoginManager" and what is the right use case for it?

Answer 1

The phrase "with your own UI" was referring to the UI elements that trigger the login flow (such as a custom login button). The authentication exchange still occurs over Facebook UI (ie, the login manager will typically app switch to the native Facebook app if installed, or to the Safari browser).