Take the 2-minute tour ×

I'm playing around with Facebook Connect, trying to use Facebook as the means or authentication on my site. Currently my workflow looks something like this:

  • Go to URL
  • Server checks cookies for AccessToken
  • If AccessToken exists, automatically fill in user's name/profile picture in comment box, and leave AccessToken in hidden input
    • send page down to client
    • on submit, verify access token (which was submitted with the rest of the form) is a valid access token for a real person. If so, add comment to Database
    • refresh page to display new data
  • if no access token, replace user's name/profile picture with <fb:login-button>, along with the required <script>s.
    • send page down to client
    • When user authorizes page/logs into facebook, refresh page
    • (go back to top, except this time the access token should exist)

So I have a few questions:

  • Is this secure? I was thinking of ways i would be able to do without the double authentication with Facebook (checking once on page-generation and checking again on comment-submission), and I could not figure any other way short of maintaining my own session-state with each client. Is that worth doing?

  • Does the access token expire when i log out of Facebook? I'm thinking it should, but it seems I can continue to use the same access token to grab data (i.e. name, url, etc.) after I manually go to Facebook and log myself out. Is it because I'm only asking for public information, and only more intrusive permissions expire on logout?

  • Given that each person who wants to do something has to provide a unique token from Facebook, this should have the side effect of blocking CSRF, since every action can be traced to a valid Facebook account. Is that right?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Why don't you just use the Facebook Javascript SDK to detect if they're currently logged into Facebook? This will also make the access token available in Javascript so you can make client-side calls to the API. You can access the same access token server side via the session cookie set by Facebook also.

share|improve this answer
The main reason is, for better or worse, I want to do as much of this stuff server-side as possible. Hence rather than having lots of javascript doing clever things with the DOM on client side after making the calls to Facebook, I just want to pass the authentication-thingy (in this case the access-token) to the server, have the server do all the thinking and have it spit out the correct (customized) page on the first try. I really don't like javascript DOM manipulation; anything non-trivial gets confusing real fast. –  Li Haoyi Aug 31 '11 at 5:57
Once Facebook's Javascript SDK sets the cookie, Facebook's PHP SDK can pick up the same session (via the cookie) - you could then make all your API calls from the PHP SDK (or form Python or whichever server-side language you use) - there should be no need to manually pass the access token yourself –  Igy Aug 31 '11 at 6:00
add comment

I can't answer all of your questions but I can tell you that having the access token in a hidden field on your page is risky from a policy perspective, especially if your page can be read by any third-party code such as Google Analytics or AdSense. Facebook will nail you for this as it is leaking user identifying data to third parties. The Facebook userid is in the access token in plain text. Facebook has automated processes that scan for this stuff and will auto-ban your app if it is leaking userids to third parties.

share|improve this answer
Hmm but isn't the access-token already in the cookies, and can't any third party who can grab the HTML i am seeing also grab the cookies? I suppose it would cost me nothing to leave the access-token out of the HTML and just have the server check the cookies on each request. –  Li Haoyi Aug 31 '11 at 5:38
Third parties won't have access to the cookies - only your user will have access to their own cookie –  Igy Aug 31 '11 at 5:51
add comment

Your Answer


