如果用户使用与注册不同的 FB 帐户，如何限制对 facebook API 的访问

Question

The scenario is: User sign up to site with facebook_account_1, (he garant accessing to the site so site store his UID in DB so he won't have to give site access right each time he tries to log in ), now he can click on "invite friends" link that will popup nice JS pretybox with his friends. So far so good. Now in new tab he manage to logout from facebook_account_1 and logs in to facebook_account_2 (while he is still using the same account on our site), ... now when he clicks on the "invite friends" link he can invite friends from that second account.

the issue is that this JS popup isn't dealing with my db stored access token (witch is logical) however I'm looking for solution how to restrict that popup to display warning message "you are already using different FB account than is your stored UID", but the way that JS -> FB communication is done I cannot just replace Requested UID, with the stored UID.

the only solution we manage to think up is just kinda compare stored FB cookie UID with the the users UID in DB, but you cannot do that because of the browser restrictions (witch is also logical)

these are things I have to keep on site: 1 site now can store only 1 FB access token (UID) 2 for now I'm not allowed to refactor the JS popup to custom interface where I can deal this problem

any ideas?

BTW sorry for the long title of question,couldn't think it shorter

Answer 1

How he managed to logout from the popup?

I would suggest you to use the standard dialogs given by the facebook, in that the url will be disabled and other things are automatically handled by fb.

The dialog can be found at http://developers.facebook.com/docs/reference/dialogs/requests/