通过客户端SDK Facebook验证

本文介绍了通过客户端SDK Facebook验证 - 安全观的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

我想我不完全理解Facebook的OAuth的API处理身份验证的方式。据我了解，它的工作原理基本上是这样的（客户端是一款Android手机，我的服务器标准的LAMP-设置）：

I think I don't fully understand the way the facebook OAuth-API handles authentication. As far as I understand, it works basically like this (client being an Android phone, my server a standard LAMP-setup):

现在的问题是，客户当然也可以通过提交一个错误的用户ID，以我的服务器假冒步数3 - 如果我的服务器响应请求的 server/getConfidentialData.php?fbID=%FBID% 和用户设法得到别人的FB-用户ID，他可能只是将其写入请求，他会得到属于别人的数据。

Now the issue is, the client can of course fake step number 3 by submitting a wrong userID to my server - for example if my server responds to the request server/getConfidentialData.php?fbID=%FBID% , and the user manages to get the fb-userID of someone else, he could just put that into the request and he'd get the data that belongs to someone else.

如果我使用的PHP-SDK，怎么能知道我的用户是否登录在Android的App或不？

If I use the PHP-SDK, how can it know whether my user is logged in in the Android-App or not?

是，这是应该在上班的路上，还是我失去了一些东西？

Is that the way it's supposed to work, or am I missing something?

谢谢，大卫。

Thanks, David.

推荐答案

唯一真正的解决办法：

您有私人用户数据的服务器，而不是一切都在Facebook上的那一刻，你需要做的服务器端登录这并不难实现，一旦你了解了流程。

The moment you have a server with private user data and not everything is on Facebook, you need to do the server-side login which is not hard to implement once you understand the flow.

在检查实图，并按照他们在这个例子中提供的指引，你是好去。

Check the diagram at Facebook and follow the guidelines they provide in this example and you are good to go.

developers.facebook/docs/howtos /登录/服务器端的登录/