Question

Please suggest or change some suitlable title for this question as i am not able to find one

I am using Facebook to allow the users to authenticate to my site.

I use Facebook Login Button and somehow i find out the user is authenticated or not.

I am developing my website in ASP.NET 4.0

I check whether the user is authenticate through Javascript.

The problem is how should i tell my server that this user is authenticated and assign some ASP.NET roles. I cannot use Ajax becuase of securoty reasons and might be a attack of Impersonation. This site may have transactions in the future so it need to be less security vunerable.

RIght now what i did is create a session using javascript and redirect to some other page and then assign roles but i am not statisfied with this method

Any help is appreciated.

Answer 1

To fix this, after facebook successfully authenticate the user i postback the website with the some arguments.

 FB.api('/me', function (response) {

                    res_id = (response.id);

                    __doPostBack('SetSessionVariable', res_id + "$" + response.first_name + "$"+ response.last_name);

                    var uid = response.authResponse.userID;
                    var accessToken = response.authResponse.accessToken;

                });

And in code i do :

                string eventTarget = (this.Request["__EVENTTARGET"] == null) ? string.Empty : this.Request["__EVENTTARGET"];
                string eventArgument = (this.Request["__EVENTARGUMENT"] == null) ? string.Empty : this.Request["__EVENTARGUMENT"];

                if (eventTarget == "SetSessionVariable")
                {
                    // Authenticate User
                 }