Facebook Connect - Authentication and Security

Question

I would like to develop an external website using Facebook Connect instead of an own login and registration process.

First: Please don't answer "See documentation on facebook.com" or so. I've read all pages there several times I think. But I can't find an answer.

For my login button I use this code:

<fb:login-button v="2" size="large" autologoutlink="false" onlogin="window.location='/index.php'">Connect with Facebook</fb:login-button>

To show the current user's name I use:

<fb:name uid="loggedinuser" linked="true" firstnameonly="false" possessive="false" useyou="false" ifcantsee="Facebook-User"></fb:name>

And finally, for the logout, I use the following link:

<a href="#" onclick="javascript:FB.Connect.logoutAndRedirect('/index.php'); return false">Logout</a>

That's quite easy. It's well explained in the documentation.

But my problems start when I want to detect whether a user is logged in or not. Facebook explains everything concerning this topic on this page.

But I don't understand what I have to do. What I want to do is this:

• If a user requests the page "members.php" and he isn't logged in, there should be a message or he should be redirected. But Facebook's JavaScript function isn't secure, is it? Normally, I use server side authentication.
• I would like to know whether a user is logged in or not to show the login button or the logout link.
• If a user is logged in, I would like to know his user id on Facebook.

Thanks for your help in advance!

Answer 1

Won't FB.Connect.get_status() do what you need ?

Answer 2

If you want to be really safe, you should check if he's logged in when he tries to get members.php on your server side using PHP library for FB.

Re the button, I'd do something like this:

FB.Connect.init(...);
FB.ensureInit(function() {
FB.Connect.get_status().waitUntilReady( function( status ) {
   switch ( status ) {
     case FB.ConnectState.connected:
        hideLoginButton();
        loggedIn = true;
        break;
     case FB.ConnectState.appNotAuthorized:
     case FB.ConnectState.userNotLoggedIn:
        showLoginButton();
        loggedIn = false;
   }
 });
});

Answer 3

You are correct that Javascript is not secure. Everything you do in Javascript is to improve user experience, not to enforce the security.

If you use the official PHP library, you simply need to add following lines of code in the beginning of your members.php,

$facebook = new Facebook(API_KEY, API_SECRET);
$fb_user = $facebook->require_login();

This will redirect user to Facebook to login if not logged in.