Access Control and Authentication using Facebook access tokens in a webapp

Question

I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account.

However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two.

Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediately have this token and thereby access to everything in the app AND on the user's Facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

Answer 1

You probably want to look at OAuth implementations. This would not only allow you to use Facebook, but many other account providers for the login. It is also an established mechanism for using third party accounts for authentication.

Answer 2

You're going about it fine, and your intuition that using a security token on an insecure channel is insecure rings true. Many sites have fallen victim to impersonation attacks because they failed to protect session cookies via TLS (gmail, facebook, twitter, linkedIn, and many others). The short answer is use OAuth2.0 properly and then use TLS for any connection that needs to carry the security token.

Answer 3

Facebook Login uses OAuth2.0 for authentication and authorization. The Login Dialog creates a trusted link between you, your users and their info.

Check the Facebook for developers website for details.