Facebook has a several security measures to protect users account, such as a user “access token” is granted to the Facebook application (like Candy Crush Saga,pool,krish 3. Lexulous Word Game), when the user authorizes it, it provides temporary and secure access to Facebook APIs.
To make this possible, users have to ‘allow or accept’ the application request so that an app can access your account information with the required permissions.
FACBOOK CAN’T FIX IT: The Facebook Security team has acknowledged the vulnerability claimed by Ahmed Elsobky, a penetration tester from Egypt, “We’d actually received an earlier report from another researcher regarding this same issue. In response to that report, we’ve been working on limiting this behavior when it comes to our official apps, since they’re pre-authorized. For other apps, unfortunately, fully preventing this would mean requiring any site integrating with Facebook to use HTTPS, which simply isn’t practical for right now.”
He demonstrated that ‘How to hack a Facebook account by hijacking access token with Man-in-the-Middle attack‘, as shown:
Facebook apps must be protected from man-in-the middle attacks, and this can be done effectively by using HTTPS to encrypt any traffic that contains sensitive information or authentication credentials.
PROTECT YOUR ACCOUNT: If You are a Facebook app developer, you should never send an ‘access token’ over unencrypted channels and Facebook users should only trust the encrypted apps and use “HTTPS Everywhere” Browser Extension for automated security.