Login Facebook Lite - Link =link=

| Issue | Mitigation | |-------|------------| | (e.g., via logs) | Use HTTPS, keep token lifetime ≤ 5 min, generate per‑session. | | Phishing (malicious link mimicking Facebook) | Verify Host header ( lite.facebook.com ) and use HSTS. | | Replay attacks | Tokens are single‑use; server marks them consumed. | | Cross‑site scripting | Encode next parameter; whitelist allowed domains. | | Device theft | Session cookies are bound to device fingerprint; require re‑auth after inactivity. |

Get a one-time password to log into Facebook | Facebook Help Center