Facebook登录的安全性（JavaScript SDK）

Question

I would like to get information how to securely save user's id using Facebook Login with Javascript SDK ?

I get it using

FB.getLoginStatus(function(response) {
    if (response.status === 'connected') {
     ->>> response.authResponse.userID
    } else if (response.status === 'not_authorized') {
        window.location.href='index.php';
    } else {
        window.location.href='index.php';
    }
});
};

but i need securely save it to mysql database. Any ideas?

Answer 1

Don't do this - if anything, take the entire signedRequest and transfer this to your server. You can then decode it and validate that it was signed with your app_secret , and that it is still valid.

Answer 2

if you're trying to avoid people pretending to be other people and using that info to hit your DB your real problem is that facebook id's aren't secret (at all).

you could try using the third_party_id value. it's one per user per app and shouldn't be discoverable outside your app. if you're looking for security that's "good enough" it may do:

FB.api("/me?fields=third_party_id,username", _updateMe);

function _updateMe(response) { /* do something with response.third_party_id; */ }