Question

I have successfully installed the Facebook registration plugin on my website, but I’m left with some unanswered question.

1. After a user is authenticated through Facebook, should I just be storing the UID from Facebook in my database to correlate records in my application with the Facebook user?

2. If I understand correctly, Facebook should send back an “Access Token” what exactly should be done with this? Should each required page in an application be checking this access token some how to verify the user is authenticated instead of calling something like FB.getSession each time you want to validate the user is still logged in?

3. If a user registers through the Facebook registration without a Facebook Account, and returns is it completely up to me to handle the authentication and storage of the username and password or dose Facebook still interject here?

4. Where and What is the App Secret used for?

5. Facebook is said to return a “Signed Request”. Is this separate from the data that is returned? Dose each request back from Facebook need to have the Signed request verified?

I have more questions coming, but I’ll start with these for now.

Answer 1

1. Yes.
2. The oauth_token can be used to make a request to the API once they give permission to your app.
3. I haven’t used this tool to save passwords but the registration flow can be found here
4. The signed_request parameter is signed using your application secret which is only known by you and Facebook to make sure that the data you’re receiving is the actual data sent by Facebook.
5. The data Facebook returns is the signed_request and it is an encoded JSON string. You can’t decode it without your app secret. You verify return data by decoding the signed_request.