1

I have a client/server application, I want to log in with Facebook to my app. I can get an access token using Facebook login from the client, then send that to server to authenticate the user. My question is, how do I know that it was my app the one who logged in to Facebook? What if another app that the user logged in to with Facebook did that request?

  • An app id is involved. The tokens passed around will not work if you mismatch the app id on the FB login form and then later validation. – Z.T. Nov 3 '16 at 2:49
  • What if another app uses the app id from my client? – Alfredo Altamirano Nov 3 '16 at 4:10
  • Do it matter which app initiated the login? You get a token from a client and verify it server to server so you know the user is the one he claims to be. The login is to authenticate the user and only you can do the server to server validation to complete the authentication – rypskar Nov 3 '16 at 7:10
1

Facebook connect is pretty much oauth openid connect with a few changes. So in order to understand the security model, it can behelpful to understand how oauth works. There are a lot of resources on that available on the net.

Your question isn't quite specific enough to give you a specific answer. I'll assume you're designing a server application designed to be used in browsers (user agents) and that you don't actually worry about which application did the original login request to authenticate the user, but rather that you want to avoid a scenario where a user which isn't authorized to use your server application can use it because he successfully authenticated himself to facebook earlier on, either directly on fb or using another app that uses facebook connect.

The comments to your original question already provide answers to this question:

When you get an access token from fb connect, you must verify it. There's an endpoint facebook provides in order to do that, so your server application must send a verification request to that endpoint. If you don't verify it, just as you fear, you could end up with an access token that wasn't meant for your app, or for another user, or had expired. If you do verify it, you will get back a json reply from the verification endpoint that contains a user id and an app id. You can compare the app id with your own app id to see if the token is meant for your application. An attacker shouldn't be able to produce a token with your app id (partly because your app id shouldn't be known to anyone but FB and you). But I the main reason why nobody can act as if they were your app is because you must provide the app secret as part of the verification process. Only you and FB know that secret. So FB can fail the verification if app secret and the app id in the token don't belong to the same app (there's actually another step involved before verification - you must first get an app access token, in order to use it with the verification endpoint, and in order to get the app token, you must provide your app id and secret).

From the verification response, you can also see whether the user id is what you expect it to be. One you've verified the token, it's authenticated and you can trust what it says about who and which app the token is for. Until you do verify tokens, they're just claims that anyone could make.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.