Question

I have a login page which will log a user into my webapp based on their facebook login details.

I then create a session to remember who they are.

What I want to know is, should I be creating and/or checking the facebook credential on every single page of my webapp, or should I simply use the session I create at the beginning to login?

For example, once they have logged in, I would like to allow them to post a message onto their own facebook wall from my app. Should I check the login credentials before they can post by recreating the facebook object, or should I simply use the stored login details already in my session and use that to post to their facebook wall?

UPDATE:

So basically, should I be using the following code as a template each and every time I want to do something facebook related, like post to their wall, login etc etc?

<?php

    session_start();

    # The facebook library
    require_once("facebook.php");

    # Create facebook object
        $config = array();
        $config['appId'] = 'appId goes here';
        $config['secret'] = 'secret goes here';
        $config['fileUpload'] = false; // optional

        $facebook = new Facebook($config);  

    # Check if user has active facebook session
    $user_id = $facebook->getUser();

        if ($user_id) {

            try {

                // do something here

            } catch (FacebookApiException $e) {

                error_log($e);
                $user_id = null;

                exit;

            }

        } else {

            $loginUrl = $facebook->getLoginUrl();
            header("Location: ".$loginUrl);
    }

?>

Answer 1

I’d check the user in every request, just in case you have brittle code that may allow a user to create sessions themselves.