Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account.

However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two.

Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediately have this token and thereby access to everything in the app AND on the user's Facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

share|improve this question
add comment

3 Answers

You probably want to look at OAuth implementations. This would not only allow you to use Facebook, but many other account providers for the login. It is also an established mechanism for using third party accounts for authentication.

share|improve this answer
add comment

You're going about it fine, and your intuition that using a security token on an insecure channel is insecure rings true. Many sites have fallen victim to impersonation attacks because they failed to protect session cookies via TLS (gmail, facebook, twitter, linkedIn, and many others). The short answer is use OAuth2.0 properly and then use TLS for any connection that needs to carry the security token.

share|improve this answer
add comment

Facebook Login uses OAuth2.0 for authentication and authorization. The Login Dialog creates a trusted link between you, your users and their info.

Check the Facebook for developers website for details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.