validating fb cookie using md5 hash

Question

Hello,

I am trying to incorporate facebook login in my ASP.NET web app and came across the following article which has a code sample for the same.

http://ntotten.com/2010/04/new-facebook-connect-in-csharp/

The following is from the article.

Next, and most importantly, the class validates the cookie. This validation uses MD5 hashing to compare the contents of key appended to the app secret to the signature that comes in with the cookie. If these values match we know the key is valid.we know the key is valid.

Why is Md5 hashing being used for that? Why not SHA or some other algo?

What happens if I don't validate the cookie? Can invalid cookies be sent to the server?

In the article, he throws a new security exception if cookie is invalid? What should the user do in such a case?

I have never really worked with cookies, so I am trying to get the basics right here.

Thanks.

Answer 1

Ok, after some more searching and going through the code, I finally got it.

http://developers.facebook.com/docs/authentication/fb_sig

Answer 2

I recommend you just use the SDK I made to do the verification. http://facebooksdk.codeplex.com. That article was basically the first code I wrote when starting that SDK. The sdk will handle pretty much everything you will need to do to develop facebook app on .Net. We use it where I work on some very large facebook apps hosted on windows azure.

The SDK will handle all the hashing/validating for you. All you need to do is this:

var app = new FacebookApp();
var session = app.Session;
if (session != null) { 
  // Session is valid 
} else {
  // Session is not valid
}

The session object is validated before it is returned to you.