用Facebook Php Sdk登录返回用户

Question

Currently I am using facebook's php ask to login to my website. When they signup, I am storing their email address fetched from facebook. When they return on website and login through facebook, the fb email is matched with the one present in database and if matched, user is logged in.

But that's not a good practice. Because if user changed email in future, he/she couldn't login and also if user changed email address to someone's, it will let him/her log in.

I have found that we can store user access token, but it is not permanent. If anyone knows how we can achieve this with better security, it would be a great help.

Answer 1

You can store and use user FB UID. This UID is permanent and unique for every user.

Also if UID is not present in your system than you can try to find this user in your DB by the email. If user with the given email is found then you can stores link "user_id_in_your_system" and UID. Next login will be processed by the given UID.

Keep in mind that some users can deny email permission for the your site