Facebook Authentication Without Redirect?

Question

Is there a way to use facebook authentication (the OAuth 2.0) without redirecting?

I am not using the facebook login button, so I am supposed to redirect to https://www.facebook.com/dialog/oauth? client_id=YOUR_APP_ID&redirect_uri=YOUR_URL, but I don't want to redirect my user outside of my page. Is there a way to open this url in a popup window (how do I do that btw?), and then catch the sessionChange event just like when working with the normal facebook login button?
I am using jQuery and Pyramid.

Thanks!

Answer 1

I made an application for a client a couple weeks ago with that behavior just using the Facebook JS SDK

FB.login(function(response){
        if(response.session){
        var user_id = response.session.uid,
            access_token = response.session.access_token;
        }
    }
);

You can the send the access_token to your server with ajax if you want. Just be careful if you're using too much ajax, the session will expire if you don't make calls to FB.getLoginStatus() every so often.

Answer 2

You can check if the user has a valid access token, in other words, was logged on to your site at some point. FB gives you the session data on the front end so get it like this:

    FB.getLoginStatus(function(response){
        //send the response to the back end in a json string
    });

Then validate it on the back end using a modified version of the legacy signature validation. It seams to work. Please let me know if I'm missing something. It only tells you that the user id, access token match for your site. No curl calls needed. It doesn't tell you if the session is actually currently valid though so don't rely on it for your banking system or anything.

function validateFB_sessionObj($sessionObj){//pass me the session data object
   $sessionObj = $sessionObj->session;
   global $fb;//pull in the secret fb keys
   if (!is_object($sessionObj) || !isset($sessionObj->uid) || !isset($sessionObj->access_token) || !isset($sessionObj->sig)){
//       warning("facebook session object is lacking something", $sessionObj);
       return false;
   }
   $expectedSig = generateSig($sessionObj, $secret);
   if ($sessionObj->sig = $expectedSig){
     //  status("fb signature looks good");
       return true;
   } else {
    //   warning("facebook signature looks wrong", $sessionObj);
       return false;
   }
}

function generateSig($params, $secret){
   $string = $params->access_token . $params->uid . $secret;
   return md5($string);
}