CODEWITHSUNDEEP
facebookapisecurity
caw
caw

Reputation: 31497

Facebook Connect - Authentication and Security

I would like to develop an external website using Facebook Connect instead of an own login and registration process.

First: Please don't answer "See documentation on facebook.com" or so. I've read all pages there several times I think. But I can't find an answer.

For my login button I use this code:

<fb:login-button v="2" size="large" autologoutlink="false" onlogin="window.location='/index.php'">Connect with Facebook</fb:login-button>

To show the current user's name I use:

<fb:name uid="loggedinuser" linked="true" firstnameonly="false" possessive="false" useyou="false" ifcantsee="Facebook-User"></fb:name>

And finally, for the logout, I use the following link:

<a href="#" onclick="javascript:FB.Connect.logoutAndRedirect('/index.php'); return false">Logout</a>

That's quite easy. It's well explained in the documentation.

But my problems start when I want to detect whether a user is logged in or not. Facebook explains everything concerning this topic on this page.

But I don't understand what I have to do. What I want to do is this:

Thanks for your help in advance!

Upvotes: 2

Views: 1923

Answers (3)

ZZ Coder
ZZ Coder

Reputation: 75496

You are correct that Javascript is not secure. Everything you do in Javascript is to improve user experience, not to enforce the security.

If you use the official PHP library, you simply need to add following lines of code in the beginning of your members.php,

$facebook = new Facebook(API_KEY, API_SECRET);
$fb_user = $facebook->require_login();

This will redirect user to Facebook to login if not logged in.

Upvotes: 4

Seb
Seb

Reputation: 17815

If you want to be really safe, you should check if he's logged in when he tries to get members.php on your server side using PHP library for FB.

Re the button, I'd do something like this:

FB.Connect.init(...);
FB.ensureInit(function() {
FB.Connect.get_status().waitUntilReady( function( status ) {
   switch ( status ) {
     case FB.ConnectState.connected:
        hideLoginButton();
        loggedIn = true;
        break;
     case FB.ConnectState.appNotAuthorized:
     case FB.ConnectState.userNotLoggedIn:
        showLoginButton();
        loggedIn = false;
   }
 });
});

Upvotes: 0

Scott Evernden
Scott Evernden

Reputation: 39966

Won't FB.Connect.get_status() do what you need ?

Upvotes: -1

Related Questions