1

I am planning to use facebook authentication for my website

 window.fbAsyncInit = function() {
  FB.init({
      appId: 'APPID',
    cookie     : true,  
    xfbml      : true,  
    version    : 'v2.2' // use version 2.2
  });

This will initialize the facebook authentication and at the end of it, there will be a facebook authentication token issued which will be stored in a cookie fbsr_APPID. Now whenever user makes a request to the server, I will be able to get the cookie using the context that comes along with the request. So i check the fbsr_APPID cookie and I get the user details as mentioned here

basically the authentication model I thought of is

     1. Client secures authentcation token from facebook oauth         
     2. Client sends request to server for crud operatins     
     3. Server checks if the facebook authentication token is valid and gets user details from it 
     4. If the token is valid server performs CRUD operations and returns results

Now is this model secure enough? (both for https hosting and http hosting)

What are the ways in which this can be hacked?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.