I am creating an Android app that uses Facebook SSO to login and I’m not sure how to authenticate with my own webservices after I login to FB. When a user first opens my app they login to Facebook, authorize my application some privileges, and continue into my app. This part works great, but now to use my app they need to create an account on my server and talk to my webservices.
Right now I have a call to an authenticate webservice on my server that adds their Facebook ID and other basic info into a database and at the same time does a Diffie–Hellman key exchange so any future calls to webservices can be encrypted by a shared key. But the problem is that very first initial call to create this account and create this shared key, how do I authenticate that? How do I know this person is really the one who just authenticated with Facebook and not just someone who found the URL for my webservice and is creating accounts and saving the keys?
Facebook SSO returns an access token. If you’d like, you can pass that along to your server and your server can make a call to the Facebook APIs to check that it’s a valid access token for that user (eg by calling https://graph.facebook.com/me?access_token=ACCESS_TOKEN) — if it is, you’re good and have verified that the user is who they say they are (or is a hacker with enough access to have a valid auth token for your app for Facebook, at which point their identity has been compromised on Facebook’s end).