How does Facebook JS API get the login results?

I understand that Facebook uses a standard oAuth2 login flow, which happens in a new window that FB.login opens.

With normal HTTP without JS, on successful login, there is a redirect somewhere.

What I don't understand is, after a successful login using the JS SDK, by what mechanism does the window opened by the FB pass back the information to the opener? Is it postMessage?

I ask because we may be implementing it in Cordova in iOS 11 and we're considering whether to open Safari or the new SFAuthenticationSession. We have ways of passing information back that involve a redirect to our own page, which then calls the app's custom url scheme (no other way to do window.close). And ibstead we may just open it in safari and then at the end set window.location to custom url scheme and then call window.close().