安全实施 Javascript SDK Facebook 身份验证

Question

I'm currently trying to implement Facebook Authentication into my website, but I'm seeing many major security holes. The only way I can communicate with the server about the user who just authenticated my app is by using some kind of POST or GET request to another page, which matches the facebook ID with a database filled with users facebook IDs and site user ids. An attacker can just obtain the faceboom ID of a user, and send an artificial request to the server, getting them access to the account. What is a more secure way of implementing the Facebook Authentication Javascript SDK with server-side communication.

Answer 1

I think this question is best repeated as: How can I best secure my login system when only sending a facebook id to log someone in? Is that correct?

I think the problem is just the same as normal log in. You need 2 fields at least to properly confirm a user's identity. Why not select their email, their id, and I believe their access token. This access token should be passed straight from facebook. You can then use this token server side and ask facebook if the token is valid.

Check this out: https://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/

Also: How to extend access token validity since offline_access deprecation

Answer 2

When the user authenticates on your server, you are also given the access_token of the user as well as their id . You can then pass the access_token to your server and do a request to Facebook using the access_token to make sure it is valid.