Question

In the authentication flow documentation here it mentions the CODE which is returned upon oAuth authentication.

Is this required for the Javascript SDK or is this handled automatically in the background in this code?

By “is this required?” I mean, do I have to handle this code to verify the authenticity of the request, or does the JavaScript SDK use the code automatically to gain the access_token.

The documentation explains the client side flow, and how to get the access token using the ‘code’ so until now. I’ve been assuming that the SDK manages this automatically in the background, because it produces an access code as response.authResponse.accessToken.

FB.login(function(response) {

    if (response.authResponse) {

        // User is logged in to Facebook and accepted permissions

        // Assign the variables required
        var access_token = response.authResponse.accessToken;
        var fb_uid = response.authResponse.userID;

        alert(dump(response.authResponse));

        // Construct data string to pass to create temporary session using PHP
        var fbDataString = "uid=" + fb_uid + "&access_token=" + access_token;
        // Call doLogin.php to log the user in
        $.ajax({
            type: "POST",
            url: "ajax/doLogin.php",
            data: fbDataString,
            dataType: "json",
            success: function(data) {

                // Get JSON response
                if (data.result == "failure")
                {
                    alert(data.error_message);

                    window.location.reload();

                    return false;
                }
                else if (data.result == "success")
                {
                    window.location.reload();

                    return true;
                }

            },
            error: function() {
                return false;
            }
        });

    } else {
        // user is not logged in and did not accept any permissions
        return false;
    }
}, {scope:'publish_stream,email'});

I would like to know, because I want to ensure that my code is secure.

Answer 1

From the documentation

With this code in hand, you can proceed to the next step, app authentication, to gain the access token you need to make API calls.

In order to authenticate your app, you must pass the authorization code and your app secret to the Graph API token endpoint at https://graph.facebook.com/oauth/access_token. The app secret is available from the Developer App and should not be shared with anyone or embedded in any code that you will distribute (you should use the client-side flow for these scenarios).

If you plan on using the FB.api function to make calls to their Graph API, then you need the code to get the access token. But if you only need to authenticate the user, then what you have will do that just fine.