使用Facebook SDK进行iOS身份验证

Question

I have a website that uses facebook connect.

I have a security related question regarding the iPhone app i'm building for it.

For the website, I keep a USERS table in my database.

The USERS table among other things has those fields:

ID   (int) an internal auto-generated id
FBID (int) the facebook user id
GUID (varchar 40) a random long guid for API uses

When a user logs into my website, after approving my website with facebook, he gets redirected to a login.php page where i get his FBID and easily log him in by creating a new user or finding an existing one. i keep the GUID in a session.

For building the iphone app for my website I downloaded the iOS facebook SDK.

Apparently, same as with the website scenario, in the end of the approvement process i get the user's FBID. The problem is that sending the FBID to my website is insecure as i see it. If i open an API that gets an FBID and logs users in - any person can send his/hers friend's FBID and log into my website in their name. Is this correct? if so - what should i do?

cheers,

Answer 1

you can send the access token along with the Fbid to your server and then make a request to facebook..

https://graph.facebook.com/me?access_token=XYZ

this will return you a list of things along with the Fbid and than you can check if both FBId's are same thus authentication is performed.. hoping this helps.