PHP cURL to verify Facebook API login access_token on server?

Question

Could anyone share a working example of how to verify on my PHP server using cURL the Facebook access_token I got from the browser, so that I can verify the login details from the browser are trustworthy then safely create a session for my user on my server?

To review, the steps I want to make work are:

1. User clicks "Continue with Facebook" on the browser and gets an access_token.
2. I send this to my PHP server.
3. The server sends a cURL request to Facebook to validate the user access_token.
4. If access_token is valid, then create session for the user on my server.

I have my own app with email, Google and Facebook login. I appreciate any help, thanks.

Answer 1

After quite some time, I got a working PHP script.

Just replace the missing variable values and it should work. Also make sure you have cURL working on your PHP server with phpinfo() or some other means;

<?php

///////////////////////////////////////
// prep Facebook verification
///////////////////////////////////////

// sanitize login data
$_POST['facebook_access_token'] = filter_var($_POST['facebook_access_token'], FILTER_SANITIZE_STRING);

// set variables
$facebook_user_access_token = $_POST['facebook_access_token'];
$my_facebook_app_id = 'REPLACE';
$my_facebook_app_secret = 'REPLACE';
$facebook_application = 'REPLACE'; // in my case 'domain.com', as set up in Facebook

///////////////////////////////////////
// get facebook access token
///////////////////////////////////////
$curl_facebook1 = curl_init(); // start curl
$url = "https://graph.facebook.com/oauth/access_token?client_id=".$my_facebook_app_id."&client_secret=".$my_facebook_app_secret."&grant_type=client_credentials"; // set url and parameters
curl_setopt($curl_facebook1, CURLOPT_URL, $url); // set the url variable to curl
curl_setopt($curl_facebook1, CURLOPT_RETURNTRANSFER, true); // return output as string
$output = curl_exec($curl_facebook1); // execute curl call
curl_close($curl_facebook1); // close curl
$decode_output = json_decode($output, true); // decode the response (without true this will crash)

// store access_token
$facebook_access_token = $decode_output['access_token'];

///////////////////////////////////////
// verify my access was legitimate
///////////////////////////////////////
$curl_facebook2 = curl_init(); // start curl
$url = "https://graph.facebook.com/debug_token?input_token=".$facebook_user_access_token."&access_token=".$facebook_access_token; // set url and parameters
curl_setopt($curl_facebook2, CURLOPT_URL, $url); // set the url variable to curl
curl_setopt($curl_facebook2, CURLOPT_RETURNTRANSFER, true); // return output as string
$output2 = curl_exec($curl_facebook2); // execute curl call
curl_close($curl_facebook2); // close curl
$decode_output2 = json_decode($output2, true); // decode the response (without true this will crash)

// test browser and Facebook variables match for security
if ($my_facebook_app_id == $decode_output2['data']['app_id'] && $decode_output2['data']['application'] == $facebook_application && $decode_output2['data']['is_valid'] == true) {
    echo 'Success. Login is valid.';
}
else {
    echo 'Error.';
}

?>

Special thanks to https://stackoverflow.com/a/16092226/6252345