Take the 2-minute tour ×

A noob question since its my first app to deal with Facebook social sign in. I am developing an app (Flash) which have the ability allow the user to

  1. create normal user account


  1. social sign in

The information both store in the same table, but with social sign in off course there is no user password store so i create a account_type which differentiate weather its from the normal user account create or social sign in from Facebook.

Is my appraoch to this correct?

Just wondering what do you need to store in the database in order to authenticate the user, if they come from Facebook social sign in. Because the authentication happen within the Flash application itself rather than going to the server and return result.

So my ulitmate question is what information do i need to store in the database for social sign-in users in order to match with their account and authenticate they are legit user. instead people can just steal email address and access all user's information.

Thanks for any kinda help

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The only thing which will identify them uniquely is their Facebook ID. You need to confirm this by requiring them to authenticate, then calling the graph through the ActionScript API to get details of the current user.

Facebook IDs aren't secured in any way (you can look them up with a simple graph call), which is why you need to get the user to authenticate with FB - it's not like ACS, for example, where you set up a relying party and receive a token string that is unique to your application.

After getting the user to authenticate, your code will look something like this:

var auth:FacebookAuthResponse = Facebook.getAuthResponse(); // Gets current authenticated user, or null if no user is authenticated.
var token:String = auth.accessToken; // Access token - only valid for this session, so you can't use this.
var user:String = auth.uid; // Unique identifier of the current authenticated FB user.
share|improve this answer
Thanks very much for your answer!! –  bluebill1049 Sep 4 '12 at 8:11
You are welcome. Remember it's not the ID that's secure (anyone can get that), but the fact that the ID is returned through a call to Facebook.getAuthResponse(). The documentation linked from the API page is quite good. –  JcFx Sep 4 '12 at 8:13
sure thing, wait answer for a whole day. –  bluebill1049 Sep 4 '12 at 8:21

Your Answer


