FB definitely sends access token via URL param for the server side flow: https://developers.facebook.com/docs/howtos/login/server-sid...
If there were a mitm they could get it even if it's in the hash. It has to travel to the client at some point.
If there were a mitm they could get it even if it's in the hash. It has to travel to the client at some point.
of course it's visible in server-2-server, but not client-server