Possible Duplicate:
Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I have some real concerns about how to use facebook login for my wabb-app. I have a standard registration and login process through https with email(including validation link)+password. However, I want to let people use facebook to login and register with my app, and since facebook e-mail is already validated, I don't even need to validate it.
I use the javascritp JDK for the login, which is the simplest way to integrate according to facebook and should be used for webb-apps. However this only certifies my user is logged in client side, I don't see how I can trust my client when he says he is correctly logged into facebook with X user and I hand him back the confidential data.
I have found a workaround for this issue as explained in this question, but have no true answer, and I would really like for an expert to explain why it seems so awkward to use facebook connect and if I'm truly understanding it right.
Thank you so much.
