API for Facebook Login

I found this answer in Stackoverflow:

http://stackoverflow.com/questions/7756878/facebook-authentication-to-my-server-using-android

So you have: Facebook - Android Application - Your web server. And your web server needs to know that you are the Facebook user you are presenting. The problem is that you can not trust the Android client for any data it gives to you.

I solved the problem like this:

1. Authenticate user to Facebook from Android application,
2. Get the FB auth token to the android app,
3. Forward the authentication token & facebook UID from Android to web server,
4. On web server, make Facebook API call with the submitted token.

If the Facebook API call from web server returns valid authentication, and the user id is equal to the one submitted by Android application, your server can trust the id (& you can be sure that the Android authentication real)

So, after I have a valid authentication, all the requests must be done with the Facebook Token? Or, as the user is validated, could use the JWT for all the next requests?

Thanks in advance!

@pdellepiane I have the same question, buddy :( Have u solved this? How can I authenticate facebook_id and new token being sent from Android app? Any ideas would be appreciated!

it works for me : //find the user using his details. $user = User::where('email','=',Input::get('email'))->where('fb_id','=',Input::get('fb_id'))->first();

//then use $token = JWTAuth::fromUser($user);

@pdellepiane After access token verification you can generate the access token like normal login(JWT) and can pass that as the response so that every next request the client can attach the access token in header authentication. There is no need of passing fb access token.