Facebook Javascript SDK security

Question

I'm in the process of using the facebook javascript sdk to provide user login functionality for a website.

What I'd like to do is simply take the logged in user's unique facebook id and then put/fetch data to/from a mysql database using the id to determine what data is available to said user.

However I don't really feel like this is very secure. Whilst I'm not storing anything sensitive like credit-card details etc, I'd obviously prefer it to be as secure as practically possible.

My fear is that with javascript being what is it, someone could fake the facebook id and just pull whatever they wanted.

I'm aware that the php sdk would provide a solid solution to this problem, but i like the javascript one mainly because it's easy to use and I have the basis of it set up (I admit it, I'm lazy).

So, my questions are:

1. Would this set up be as insecure as I feel it might be?

2. Is there anything I can do to improve the security of such a system, other than switching to the php sdk?

Thanks!

Answer 1

Facebook Ids are pretty hard to make up (at most a user will only know their own). Depending on what you store in the database (which will not be anything that the user cannot get on their own, unless you ask for extended permissions)

If you are worried about a user trying to get information from the database, add an access token or signed request to each row and us that and facebook id to get data. That will greatly increase security.

EDIT

There are few occasions where you get a signed request from a user:

* A signed_request is passed to Apps on Facebook.com when they are loaded into the Facebook environment
* A signed_request is passed to any app that has registered an Deauthorized Callback in the Developer App whenever a given user removes the app using the App Dashboard
* A signed_request is passed to apps that use the Registration Plugin whenever a user successfully registers with their app

Signed requests will contain a user id only if the use has accepted permissions though, and are not passed again if the user enters the application, and accepts permissions (meaning that the signed request would not contain the ID). Because of this saving an access token may be a better idea. Here is more on the signed request

Also the signed request is in the url (param = "signed_request"). I always parse it through c# but I am sure you can at least get one through javascript