移动应用程序如何使用API​​并证明其想要修改的Facebook ID已登录并在Facebook上授权？

Question

I am using the Facebook PHP SDK in a server-side API which is used by several mobile apps (iOS & Android) and a website to read/write data to the database.

I cannot see any reason why the web version will not work because the sessions set by Facebook can be read from the browser via the SDK.

So if I am using:

$facebook = new Facebook(array(
  'appId'  => 'xx',
  'secret' => 'xx',
));

// Get User ID
$user_id = $facebook->getUser();

And the $user_id is set, then I can get the user information for the logged in user. This means that when I am saving, updating or getting records from the database they are guaranteed to only be for the logged in user and cannot be spoofed.

How to securely communicate from mobile web app to server using Facebook PHP SDK

So, how would this be replicated for a mobile application? How can the mobile application use the API and prove that the Facebook ID it wants to modify is logged in and authorised on Facebook?

Answer 1

If I understand correctly, you have a user logged in on your mobile app and you want to access stored data on your server. (Or maybe the other way around, can't really tell from your question).

Aside from the custom authentication solutions you can use, have you considered passing the facebook access token instead of the id as a simpler solution. The access token expires, it's not public and you can easily exchange it for an id from facebook or parse the token itself. Here is an example solution:

How to get the Facebook user id using the access token You can also validate the user on the server or client side easily with the token. I haven't used this solution with mobile apps, but have used something similar for multisite apps. Good luck