title: Why would a backend need third-party authentication?
body: <p>I am trying to implement Facebook authentication on my app. I noticed my API backend - <a href="https://loopback.io/" rel="nofollow noreferrer">Loopback</a> has <a href="https://loopback.io/doc/en/lb2/Third-party-login-using-Passport.html" rel="nofollow noreferrer">passport</a> integration. I don't understand what would be the purpose of this? </p>
  
  <p>From what I understand the authentication happens on the client side. And the FB issued token should be passed to the backend for generating a session cookie / token to talk with my app's API. So the backend should only be validating th FB user token, not actually authenticating the user.</p>