https://developers.facebook.com/docs/reference/dialogs/ Lists the various different Facebook dialogs, but "permissions.request" is not on the list. The Permissions Request dialog has a URL of https://www.facebook.com/dialog/permissions.request?... The parameters consumed by this URL follow the same conventions as the other dialogs described in the above referenced documentation.
The Permissions Request dialog currently works fine when rendered in an iframe (set the "display" parameter to "iframe" and also pass a valid "access_token" parameter). Is this officially supported, or is it an oversight/bug?
The oauth dialog is deliberately not allowed to be rendered within an iframe to prevent clickjacking. Was the decision not to prevent clickjacking attacks on the Permissions Request dialog a deliberate one?