I'm looking for a high level overview of how the Facebook JavaScript SDK authenticates users, and the techniques involved.

All JavaScript apps use this standard code to import the Facebook Single Sign-on:

<div id="fb-root"></div>
<script>(function(d, s, id) {
  var js, fjs = d.getElementsByTagName(s)[0];
  if (d.getElementById(id)) return;
  js = d.createElement(s); js.id = id;
  js.src = "//connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.6&appId=903880373009283";
  fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>

<div class="fb-login-button" data-max-rows="1" data-size="icon" data-show-faces="false" data-auto-logout-link="true"></div>

The imported script is here: http://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v2.6&appId=903880373009283

How does the imported script interact with their server?

Most of it is open source... and I'm only interested in the security components (not the GUI aspect).

My goal is to extrapolate best practices and lessons learned.

  • Are you asking about this specific snippet or the one that gets loaded? – Robert Mennell Jul 7 '16 at 16:19
  • @RobertMennell The one that gets loaded... (linked above). Unless I misunderstand where the script is coming from (e.g. there is yet another outside link somewhere) – goodguys_activate Jul 7 '16 at 18:55
  • Okay. That was a little confusing in your question. – Robert Mennell Jul 7 '16 at 18:56
  • Feel free to edit and help me rephrase @RobertMennell – goodguys_activate Jul 7 '16 at 19:31
  • Eventually going through it it's WAY to broad of a question to be answered here. There's probably a wiki devoted to this thing it's so massive. – Robert Mennell Jul 7 '16 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.