title: Validating the user of an access_token
body: <p>In the Facebook dev article <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow" rel="nofollow">Manually Building a Login Flow</a>, there is a section entitled "Confirming Identity". It mentions that you need to validate codes and tokens that you receive from them via your <code>redirect_uri</code>.</p>
  
  <p><strong>My question</strong>: Since you don't know anything about the user that just logged in, how do you validate that the <code>user_id</code> that you see in the response from the <a href="https://developers.facebook.com/docs/facebook-login/manually-build-a-login-flow/#checktoken" rel="nofollow">token inspection endpoint</a> is correct?</p>
  
  <p>The article says: </p>
  
  <blockquote>
    <p>As a result, your app should confirm that the person using the app is the same person that you have response data for before generating an access token for them.</p>
  </blockquote>
  
  <p>But, how can you actually do that? Are we expected to show publicly available info about that <code>user_id</code> back to the user with a UI that asks "Is this you?". I haven't seen any apps/sites that do that, so I'm assuming that this isn't practically done.  </p>
  
  <p>Am I missing something?</p>