Hardcoded Facebook access token in source codeSCT-1063

Leaking a Facebook access token in source code can pose serious security threats as it can allow unauthorized access to a user's Facebook account, leading to potential data breaches and privacy violations. The access token should be treated as a secret and not be hardcoded in the source code.

If a Facebook access token has been exposed, it is recommended to immediately invalidate the token and generate a new one to mitigate the vulnerability.

To address this issue, it is advised to use environment variables or a secure secret management system to store the access token. Storing the token separately from the source code ensures that it is not easily accessible to unauthorized users. Additionally, using environment variables or a secure secret management system allows for easier management of the access token as it can be updated or revoked without modifying the source code.

Bad practice

import requests

FACEBOOK_ACCESS_TOKEN = "EAA..."
user_id = "123456789"

response = requests.get(
    f'https://graph.facebook.com/{user_id}/friends',
    params={'access_token': FACEBOOK_ACCESS_TOKEN}
)

Recommended

import requests
import os

FACEBOOK_ACCESS_TOKEN = os.getenv('FACEBOOK_ACCESS_TOKEN')
user_id = "123456789"

response = requests.get(
    f'https://graph.facebook.com/{user_id}/friends',
    params={'access_token': FACEBOOK_ACCESS_TOKEN}
)