title: Is it safe to have facebook App ID embedded in the UI javascript code?
body: <p><a href="https://developers.facebook.com/docs/javascript/reference/FB.init/v2.5" rel="noreferrer">Facebook's documentation</a> says that we can initialise FB in our app by running the following code. The code is from the documentation but this also expects <strong>'appId'</strong> to be passed as parameter. </p>
  
  <p><strong>Question</strong>: Is it really secure to have the <strong>'appId'</strong> embedded in a single page application's client side Javascript code or should this be handled on the server side somehow ?  </p>
  
  <pre><code>FB.init({
      appId      : '{your-app-id}',
      status     : true,
      xfbml      : true,
      version    : 'v2.4' // or v2.0, v2.1, v2.2, v2.3
    });
  </code></pre>
  
  <p>Update: As @KK pointed out the documentation says <code>app-secret</code>. So I'm guessing it's safe to have <code>app-id</code> in the browser but I should keep the <code>app-secret</code> safe. When I check my facebook dashboard I can see I have two different ids for <code>app-id</code> and <code>app-secret</code>.</p>
  
  <p>Even if I kept <code>app-id</code> on the server and redirected the user via the server, the app-id will still be visible to the user because the <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow#exchangecode" rel="noreferrer">documentation here</a> says that the redirect url is a GET request so all the parameters are visible anyway. </p>