I came here with a struggle issue. We run a social media website, where people can register by classical login (might be his email or his username) and password form but also using a Facebook Connect.
When a user choose the second option, we ask for his authorization to connect to FB Auth and then FB gives us some details, as today we use the Facebook registered email as login, and his Facebook ID as password.
When we saw that we could change our main email address on fb, we knew we had to change our way to connect them. So we thought about just sending his FB ID to Authenticate the user.
To avoid any sniffing issues we added an SSL certificate. But we still have an issue : Even with minification on our Angular APP, a user could know with a little research that to authenticate his-self to our service he "just" have to know his ID and send it to us with postman.
So if he can get the Facebook ID of another user (which might even have been leaked/sold on another website), he could use Postman to authenticate as another user.
How can I secure this process ?
We thought about using asymmetric crypto where client would cypher the ID with the pub key and server would decipher it with private key. But after all, it doesn't seems to fix the problem.