title: Best Practice on Implementing Social Login on Mobile App
body: <p>I'm currently building a web service to allow a mobile app to login to our app using Facebook.
  What is the best practice on implementing that feature?</p>
  
  <p>My current flow is :</p>
  
  <p><strong>1st condition : User haven't registered yet...</strong></p>
  
  <ul>
  <li>User tap "Login with Facebook" button in the mobile app.</li>
  <li>And then, user allows permission for the Facebook app that I created
  for the mobile app.</li>
  <li>The app retrieved email address, Facebook ID number, and Name from
  the Facebook API</li>
  <li>The app check if the Facebook ID &amp;&amp; Email address already registered
  in our database</li>
  </ul>
  
  <p><strong>If not registered :</strong></p>
  
  <ul>
  <li>The email address, Name, will be automatically filled into the
  Registration form</li>
  <li>After submitting, the app sends the information (Fullname, email,
  hashed password, and facebook Id to the server, registering the user)</li>
  </ul>
  
  <p><strong>If already registered :</strong> 
   - The server returns the token code, which used for in-app activity</p>
  
  <p>Do you think there will be a security issue there? I'm thinking if maybe someone knows you, knows your Facebook ID which can be fetched using Graph tool, and possibly know your email address, that people can logged on to the app easily by sending all the data to the server.</p>
  
  <p>ALSO, I'm thinking of implementing the same method with Twitter, but it seems that email cannot be retrieved using Twitter API.
  Any work-around on using Twitter API?</p>
  
  <p>Thank you very much for your answer.</p>