To develop @luschn's answer , the permissions that HybridAuthFacebook asks for by default (starting with version 2.4.1) email, user_about_me, user_birthday, user_hometown, user_website, offline_access, read_stream, publish_stream, read_friendlists.
Here's how to remove those discounted areas in the configuration file HybridAuth:
<?php
return
array(
'base_url' => 'http://localhost/your/hybridauth/endpoint/index.php',
'providers' => array (
'Facebook' => array (
'enabled' => true,
'keys' => array ( 'id' => 'YOUR-APP-ID', 'secret' => 'YOUR-APP-SECRET-TOKEN' ),
'scope' => 'email, user_about_me, user_birthday, user_hometown, user_website, read_stream',
'trustForwarded' => false
),
),
);
source
share