Authenticating credentials retrieved from facebook on my own REST API

Question

My team and I are working on my own mobile social network for Android, which allows users to log in using Facebook. Ive managed to implement the Android SDK for Android, but they managed to figure out how to correctly / securely authenticate a user who logs in using facebook with credentials received only from Facebook. Currently, here is my system:

Step 1. From the Android client, the user clicks on the Facebook login and provides permissions for my application.

Step 2. After the user grants our permissions, Facebook will send us a response that includes the user ID fb, email address and token (among other information, if this is the first time the user has logged in using facebook)

Step 3. Information is sent to our API for authentication

, and this is where I am a little unclear .... How do I verify the credentials on my server?

At the moment, I'm just checking my db for an existing user with fb_uid and fb_email received, but everyone can get anyones fb_uid, and it’s not so difficult to find the email that they used to register with facebook, which means that someone can hypothetically it’s easy to hack another user account with a fake HTTP request.

Answer 1

access_token , if valid, will allow you to access some Facebook user data that your application has requested access permission. One way to verify that the credentials you receive is correct is to use access_token to request Facebook.

For example, this page offers how to open access_token properties with a GET call:

 GET graph.facebook.com/debug_token? input_token={token-to-inspect} &access_token={app-token-or-admin-token} 

Which then returns:

 { "data": { "app_id": 138483919580948, "application": "Social Cafe", "expires_at": 1352419328, "is_valid": true, "issued_at": 1347235328, "metadata": { "sso": "iphone-safari" }, "scopes": [ "email", "publish_actions" ], "user_id": 1207059 } }