Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • In step 1, use a session token, not a persistent one. In step two, you talk about sending a user's email. Where do you get it, and why do you need it? In step 3, you don't necessarily get an email adres back from Facebook, you do get a user id though. Commented Jun 16, 2014 at 17:44
  • Thanks, but I don't use a session on the server because of the RESTful api. I just want to keep the user logged in until either the cookie or the access token expires. I get the email from the FB server when the user allows email access. I use it to identify the user record in my own database, because the Facebook userId doesn't correspond to the userId's in my own database. The only commong identifier that I see is the email address. Then I can store and cache the access token + userId of my own application. Commented Jun 17, 2014 at 6:21
  • A session token just means a non-persistent one, it doesn't imply a session on the server. When a Facebook user logs in for the very first time, just create an internal user and remember the mapping between Facebook user id and internal user id. After that, for a second or later login, you have the mapping. Commented Jun 17, 2014 at 18:15
  • Good idea. When I started to investigate about a way to merge accounts, I became aware that I need to create a local user and map that local userId to whatever 3rd party accounts that I have. Why I wanted to use a persistent cookie is because when the user closes the browser by accident, he would need to authenticate every time again (if eg. he would want to use my internal login system with email + password). Therefore I thought that saving user + token with expiry of eg. 60 minutes would be a good idea. Your opinion? Commented Jun 18, 2014 at 10:08