Question

In Twitter for example I can do an HTTP call to their REST API like this:

https://twitter.com/oauth/authenticate?force_login=true&oauth_token=…..

This forces the user to login even if it’s already logged in to Twitter.

Facebook has a sort of similar mechanism that works with their JS SDK,

https://developers.facebook.com/docs/howtos/login/client-side-re-auth/

but there’s no trace of the ‘&auth_type=reauthenticate’ option in the normal REST API:

http://developers.facebook.com/docs/reference/dialogs/oauth/

Anyone knows if it is hidden, or non-existing there?

Answer 1

You can use auth_type=reauthenticate in a server side authentication just like how it is in JS.

    $dialog_url = "https://www.facebook.com/dialog/oauth?client_id=" 
   . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
   . $_SESSION['state'] . "&scope=user_birthday,read_stream&auth_type=reauthenticate&auth_nonce="
   . $_SESSION['nonce'];

Read more :

https://developers.facebook.com/docs/howtos/login/server-side-re-auth/

It gives you a really good documentation of how to use it, with the necessary codes. You can also check if the $_SESSION['nonce'] send ,and received back is same as well.