CODEWITHSUNDEEP
facebookfacebook-graph-apidevise
EricBoersma
EricBoersma

Reputation: 1019

Confirming a Facebook Access Token?

We're using the Facebook JS SDK to authenticate users to our application, then sending that information to the server back end to log our user into the application (we support multiple forms of authentication but we can only support FB using a client side flow).

FB is able to log in correctly, I'm able to authenticate the user and everything else, but there's one wrinkle that I'm not sure how to handle, and I'm having difficulty finding anything in the documentation about it. Facebook sends back an accessToken in addition to an id. My question is, how do I verify on the server side that the accessToken is correct for the given id? I want to make sure that the data the user sends us matches what Facebook sent them, and I can't imagine this is that out of the ordinary, yet I can't seem to find any documentation on it.

Upvotes: 1

Views: 79

Answers (2)

cpilko
cpilko

Reputation: 11852

In the response from Facebook should be a signed_request string that can authenticate that the data is genuine with and decoded to yield the user id and an oauth token for the user.

Passing this along with the other response to your server-side code should allow you to validate everything pretty easily.

Upvotes: 2

Hugo Dozois
Hugo Dozois

Reputation: 8420

May I suggest this answer from another question! It uses try-catch. It is probably the only way to verify that the authentication and the permissions are valid! That's how they do in their examples

Facebook OAuthException: (#1)

I dont think facebook provides any other way of checking

Upvotes: 0

Related Questions