I want to encrypt sensitive data on my app server (facebook app) in such a way that my app may only decrypt this data when the user is in an active session. I need to be able to reliably derive/regenerate/salt a key to encrypt/decrypt this data, and I would like to use something that facebook will only send to my app when that user is actively logged in, will always be the same between sessions for that specific user, and is not easily forged from information available to other users or apps. Is there any such piece of secret information in either the OAuth 2.0 or the Facebook Connect API that is both user & app specific and will be consistent between sessions?

The purpose for this is to retain a private key of a key-pair that I generate for each user... thus allowing users to exchange bits of sensitive data between one another (or rather, for my app to exchange bits of sensitive data internally) in such a way that this information is secure even if data on the app's server becomes compromised... (I do understand that if the app's server remains compromised for a period of time, that this sensitive information may still be gathered from all users that have had active sessions while the server was compromised. But, I would like to minimize the amount of damage possible in the event that the server becomes compromised... such that any data extracted from the server is useless without each individual user's secret information/key)


OAuth 2.0 does not specifically provide you with what your looking for but in most all cases after getting your OAuth token (in many cases when you get your oauth token) you'll have acces to a user id of some kind. The id will be different from each provider though. For Facebook OAuth in particular, they just give you the access_token and then you need to make a request to the porfile page for the id.


There is an example of this seen in the docs here:


| improve this answer | |
  • The user id is normally public data, isn't it? – Duncan Jones Dec 20 '17 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy