Home/ Questions/Q 8769775
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T17:25:32+00:00

I’ve a simple application, that requires facebook signup/login built in Rails 3 that works

  • 0

I’ve a simple application, that requires facebook signup/login built in Rails 3 that works exactly as I want it to.
Meanwhile, I had several requests to make it behave like an API, the web app is a social media tool where people publish content to their own social networks. i’m converting the system to provide a solution for the following problem:

  • 3rd party website having their own login system
  • They want to make a button – publish through X service – and as soon as the user presses the button he will be shown the Facebook Permissions’ dialog for my own fb app, as soon as he authorizes it the content will be published

So far, while the webapp was a standalone website, this was really easy to do – they would go to my webapp, login with facebook and published whatever they wanted to, however, I’m finding it hard to come up with a solution that doesn’t present any security issues. Here’s what I was thinking:

  • I provide a JS SDK which:
    • the 3rd party install in their website -> a special method is associated with a button
    • Once the button is pressed, the user is redirected to FB (sets de redirect_ui to be the current page)
    • catches the params whenever FB redirects back (as soon as the user gives the permissions)
    • Push the content through Facebook and so on
    • the 3rd party provides a callback that will run as soon as the content is published (I send them the FB_ID and access token)
    • The 3rd party can now make calls to all my API given they will send the FB_ID and access token which I sent as soon as I had the permissions

Will this work ? Can I easily catch back the FB redirect ? Are there any security issues ?

Thanks in advance,
Ze

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    My system does something quite similar. I provide API to 3rd party sites and make calls to Facebook on behalf of their users.

    The approach I took was to implement my system as an oauth provider. This way, when the user logs in on the 3rd party site, he’s presented with my login page, which on click or by redirection, redirects him to Facebook oauth flow.

    3rd party–>my site–> Facebook

    However, this might be a bit of an overkill in your case.

    • 0