Skip to main content
Information Security

Return to Question

Tweeted twitter.com/#!/StackSecurity/status/278756658530881536
Removed signature
Source Link
edit approved Dec 11, 2012 at 22:53
jonsca
edit approved Dec 11, 2012 at 22:53
jonsca
  • 343
  • 1
  • 6
  • 21

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account. However

However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two. Just

Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediatlyimmediately have this token and thereby access to everything in the app AND on the user's facebookFacebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

Regards,

Apoc

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account. However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two. Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediatly have this token and thereby access to everything in the app AND on the user's facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

Regards,

Apoc

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account.

However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two.

Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediately have this token and thereby access to everything in the app AND on the user's Facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

Source Link
Linus
Linus
  • 131
  • 2

Access Control and Authentication using Facebook access tokens in a webapp

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account. However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two. Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediatly have this token and thereby access to everything in the app AND on the user's facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

Regards,

Apoc