I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of Facebook and Google. I understood the basic concept. For example, lets say for Facebook login the steps are:
- The user will click on "FB Login" button.
- The user will be asked to login to Facebook and allow permission. If user allows it will return an authorization code.
- Now we will use the authorization code to get an access token.
- We can store the access token in session to start a user session.
- Now we can use the access token to access to different user resources.
Now I have some confusion after step 3. Should we generate access token each time the user logs in or store the access token in our DB?
If we store the access token in our DB, how we can reuse it when a user comes to our site after 10 days (let's say he cleared the browser cookies) and click on "FB Login" button again. Because when user clicks the 'FB Login' button again he will get a new authorization code and have to start the complete process again. How can I recognize that this user already has an access token in my DB?
Any help would be greatly appreciated.