Rule Definition
Android Protected Confirmation doesn't provide a secure information channel for the user. Your app cannot assume any confidentiality guarantees beyond those that the Android platform offers. In particular, don't use this workflow to display sensitive information that you wouldn't ordinarily show on the user's device. After the user confirms the message, its integrity is assured, but your app must still use data-in-transit encryption to assure the confidentiality of the signed message

Violation Code Sample

public class FrameActivity extends BaseActivity { 

 public static CallbackManager callbackManager; 
@Override 
protected void onCreate(Bundle savedInstanceState) { 
// FacebookSdk.sdkInitialize is called in the Application onCreate 

callbackManager = CallbackManager.Factory.create(); 
} 
@Override 
public void onActivityResult(int requestCode, int resultCode, Intent data) { 
    super.onActivityResult(requestCode, resultCode, data); 
     

}

Fixed Code Sample

public class FrameActivity extends BaseActivity { 

 public static CallbackManager callbackManager; 
@Override 
protected void onCreate(Bundle savedInstanceState) { 
// FacebookSdk.sdkInitialize is called in the Application onCreate 

callbackManager = CallbackManager.Factory.create(); 
} 
@Override 
public void onActivityResult(int requestCode, int resultCode, Intent data) { 
    super.onActivityResult(requestCode, resultCode, data); 
    callbackManager.onActivityResult(requestCode, resultCode, data); // FIXED 

}

https://www.owasp.org/index.php/Mobile_Top_10_2016-M4-Insecure_Authentication https://developers.facebook.com/docs/reference/androidsdk/current/facebook/com/facebook/callbackmanager.html/