I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account.
However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two.
Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediately have this token and thereby access to everything in the app AND on the user's Facebook page.
Is there a better way of doing this securely? Or am I going about this in completely the wrong way?