Consider this scenario
Step 1: App asks user to "Sign In" using Google or Facebook.
Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app specific data
- Since the authentication is purely happening at the client level(iOS/ Android), there is no way for my server to know if user is a valid Google or Facebook user.
- The reason is that on the server if someone knows the API, they can easily play around with the system.
How do I handle such scenarios to make sure the server has confidence over the user data coming from Google/Facebook?
P.S: I am building a mobile application for the first time and this question may be a stupid one, but I don't know how to work with such a situation.