I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough.
This is the flow (all communication is made over SSL):
User logins to Facebook through the mobile app.
The app passes the user's Facebook short term access key to the server.
The server uses the key and makes a request to Facebook to retrieve the user details and to get Facebook long term access key.
If the request to Facebook is successful a user is created in my DB.
An object is then created for that user, which includes his Facebook ID, Facebook Token and creation date. That object is encrypted using Rijndeal (256 bits) and returned to the client. From now on all requests from the client include that token. The token is valid for 48 hours. When the token expires I once again use Facebook's access key and make a request to Facebook. If Facebook's access key is still valid, a new token is generated and returned to the client.
- When the user wants his data, the client sends the token, if the decryption of the token is successful I use his Facebook Id (which is also the ID I use for the user), which is part of the token, to retrieve his info and send it back to the client.
I have two questions –
- Is that flow secure?
- When I encrypt the token, should I use different IV and salt for each token? (My assumption is that it is necessary, but does it mean I should store the IV and Salt in the DB, and actually retrieve it in every call the client makes – seems quite expansive).