Question

Currently on our website we enable users to login/register with their Facebook credentials using graph api. We are creating a mobile app and we want to support login with Facebook as well. I know about the Facebook Android SDK and how to retrieve the access token, my question is:

1. Once I have the facebook access token, how can I authenticate the user with our backend system.

One idea is to pass the access_token to my backend server and query for the user’s facebook id (I don’t want to pass the facebook id because someone can just spoof the request). Now using the facebook id I can then associate it with our user id and log the user in.

1. Would this method work, or there’s another solution

Answer 1

The approach I described above works for well. Here’s the summary:

1. Facebook connect through the iPhone app
2. Retrieve the fb access token on the phone
3. Send the fb access token to your Rails server

4. The controller that you are using will check for the fb param and query the user information

   Sample of how the controller might look like

  if params[:fb_access_token]
    @graph = Koala::Facebook::GraphAPI.new(params[:fb_access_token])
    @me = @graph.get_object("me")  
    if profile = Profile.find_by_facebook_uid(@me["id"])
      user = profile.user
      render :text => user.access_token
    else
      render :text => "unregistered", :status => 401 and return
    end
  else