Security with facebook API

Question

I have some problems with the implementation of my first application with "Login to Facebook". The user MUST be registered on my system, but he can associate an FB account with him. When the FB account is linked, I just save the user's email address from facebook.

When the user clicks "login with facebook" (given that he is already registered with facebook), I simply look at his email profile and send it to the server to check if the user has an email associated with him. If such a user exists, I create a session for this user. This is the code to capture the user’s email and send it to the server:

function login() { FB.api('/me', function (user) { $.ajax( { url: "my_ajax_page.php", type: "POST", data: {controller: "MyController", action: "LinkEmail", fbmail: user.email}, success: function (response) { if(response == 1) { alert("Success!"); } }, error: function () { alert("Error"); } } ); } ); } 

There is a big security flaw with this approach, anyone can create a script to send emails to my system, and this “wrong” email will be associated with the current registered user account:

 function hacking() { $.ajax( { url: "my_ajax_page.php", type: "POST", data: {controller: "MyController", action: "LinkEmail", fbmail: ' [e-mail] '}, success: function (response) { if(response == 1) { alert("Success!"); } }, error: function () { alert("Error"); } } } 

What approach can be used to secure login with FB?

Answer 1

Perhaps you should send signed__request as another parameter to call Ajax. Only your application with its `app_secret can decode signed_request , so if you can decode it, it means that the call originated from a valid user (user) on Facebook.

You can learn more about signed requests at this link:
https://developers.facebook.com/docs/authentication/signed_request/