CODEWITHSUNDEEP
javascriptfacebook
Brian
Brian

Reputation: 4984

Validate Facebook JavaScript API response

Is there a way to validate the response from say:

FB.api(
  {
    method: 'fql.query',
    query: 'SELECT name, pic FROM profile WHERE id= ' + FB.getSession().uid
  },
  function(response) {
    //...
  }
);

Validating the cookie for login is easy enough using a MD5 hash and the application secret key compared to the provided sig parameter. However in the case of the api calls, what would stop someone from using firebug to change the response? Obviously this can be done on the back end for sensitive information but i'd like to keep as much of the back and forth bandwidth to Facebook on the clients end as possible.

Any thoughts?

Upvotes: 0

Views: 447

Answers (2)

ifaour
ifaour

Reputation: 38135

I can't think of anything harmful the user can do other than breaking his own experience in your application UNLESS you are getting these inputs (responses) and processing them/saving them to the DB for example:

  1. Having an input field where the user can update his FB status through it, and you want to save that to your own DB too?
    In this case you would/SHOULD do the usual input validations (mysql_real_escape ..etc) anyway.
  2. Saving the user Email?
    You already can get almost all the information about the user using server-side calls once the user is authenticated and grant your application access..for instance to save the user email you shouldn't wait for the user to send it to you when you can acquire it using the email permission

Upvotes: 1

scunliffe
scunliffe

Reputation: 63588

Any validation you might do in JavaScript(1) would be something the user could overcome with a little JS of their own.

If you need to ensure that communications to/from Facebook are secure and not interfered with... then do it on the server.

(1) e.g.

if you had a validateFacebookResponse(resp); function... an end user simply needs to re-declare the function...

function validateFacebookResponse(resp){
  return true;//always return true!
}

and any "security" you had is out the window.

Upvotes: 0

Related Questions