0

I read all the articles on FB regarding PHP login, JS login, Canvas app login, but something remains unclear to me. How does one keep a user logged in after the initial login in JavaScript? You receive a signed_request (which you can use to authenticate the user ONCE (on initial load of a canvas app and on login, right?), let's say you use that information to verify the user server-side. Ok, so far.. But what about subsequent page loads?

Basically my question is this.. Can I use the PHP FB SDK to verify a user is authenticated on each page load without an API call? How? Is there a way to do it that is compatible with canvas?

The reason I don't want any API calls is because I hit the limit once and my app went down for an entire night. Don't want that again...

A workaround I'm thinking of is to store the user token (which I want to anyway) and use that in a session/cookie to authenticate the user on every page load in PHP, but I'm not sure if this is the best approach, because: Using my own session/cookie would allow a user to stay logged in even if they are not logged in FB. Also, I presume FB wouldn't allow this for a canvas app.

I found these relevant questions, but the information is from 2011: PHP: Using Facebook OAuth with less API calls Facebook Login: How to combine JavaScript with PHP SDK?

Community
  • 1
  • 1
Paul Cristea
  • 453
  • 4
  • 10

1 Answers1

0

The workaround you mentioned is the right way of doing it. Saving tokens, using and updating them as they become expired - the way most companies stick to.

Only in cases of new users or expired tokens the OAuth should be used. The API you use is not important. You can actually retreive authentication through JavaScript and pass it to PHP for further usage.

Cheers.

Andrey Petrenko
  • 380
  • 2
  • 3