Secure communication between iOS client, Facebook API and server

Question

I would like to implement an iOS app with Facebook login. I would like the users of my app to be able to interact with their social graph (i.e. post to their stream). For that purpose I would use the Facebook iOS SDK.
When the users are already authenticated with Facebook, they also should be able to use some services on the server side of my application. How can I verify a user against the services on my server?

In my iOS app I can query the access token (for my Facebook application) using the iOS Facebook SDK. Should I send that access token together with the facebook user ID to my server? Can the server verify whether the access token is valid? Or should only my iOS App communicate with the Facebook API? Can the server post to my Facebook wall, or should this be done exclusively throught the iOS app?

Answer 1

UPDATE:

Facebook now provides a security documentation / checklist: https://developers.facebook.com/docs/facebook-login/security/

---

You have at least two options:

1. Send the access token to your Server and handle all requests to Facebook using that token (if the token is invalid you get an error and just pass it on to the client). => Safe but (a little) complicated.

2. Separate the communication between

   • your client (iOS App) and the Facebook API and
   • your Client and your Server.
     
     

   Your app would handle all requests to the Facebook API through the Facebook iOS SDK and then communicate the resulting data, like all kind of Facebook ids, to your Server. This approach is totally insecure without some sort of encryption; you could send some cryptographic hash function to your server and validate it with a key stored on your server and the iOS App. => This method is (a little) easier to implement however less secure since the key can be stolen through reverse engineering. Moreover you would have to check the "I'm using encryption" check mark when submitting your app to the app store.

It actually depends on how much risk you are willing to take, what kind of requests you make, what kind of services you have and so on.

Can the server verify whether the access token is valid?

Yes, look here: Facebook access token server-side validation for iPhone app