I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer.
On the android app there is two buttons, sign in with facebook and sign in with Google. When the user clicks either of these buttons, a request will be made to the fb/g+ api from the client using their sdk provided by fb/g+ and it returns a uniqueid, name, email, profile-img-url and gender.
after that, I use the user email and id to check if an account with the email and id exists or not. This is done with a php script that does a prepared sql statement. if the user exists then the script will return user data, if the user does not exists, I will send another request to another php script to sign up the user with all the details i got from the authentication.
I fear there are many security problems with this. I know that many apps have been through the same problem. I use a 10 digit id and the users email to sign in the user, can you please explain whether if there is any way that an attacker knowing the email could sign in to another users account. The attacker could also try multiple times because signing in a basic json request with the email and id as parameters. I could safeguards in the app that will prevent the users trying more than a few times but I think the ability for an attacker to try as much as they want is a risk, any suggestions to make it harder for an attacker to try multiple times in a small period of time?