javascript - Facebook Connect help -

-

According to the Facebook API documentation, most of the work is done via Javascript

This means that All processing is done, and then front end checks that the user is connected to facebook / authorized. right?

My question is:

Suppose a user first visits my site. He clicks on "Facebook Connect" Javascript verifies it as authentic, and it "redirects" to the second page on my server, since then, how will I know that the user is actually authenticated on my website because Everything is done on the forehead?

I think this is correct, but there are not some security problems ..:

- Login after user, a page on Facebook Redirects my site to And they also make a cookie with a specific "Facebook ID" that is only obtained from this user. Please "read" my supported cookies and grab that ID ... and then add it to my user id.

If this is correct ... then it does not understand. What if people steal other people's "Facebook IDs" and then make cookies? And then looks at my backend cookie and thinks this is the real user ...?

Am I confused? If I am confused, then help me rearrange and tell me how it is.

Facebook Connect uses a clever (or crazy, depending on your hypocrisy) Hack into the browser to get cross-site communication between your site and the authentication system of Facebook.

The way this works, it is as follows:

  1. Your site contains a very simple static HTML file, which is a cross-domain communication channel This file is known as the xd_receiver.htm in the FB docs, but it can be given a name for you.
  2. Your site's login page contains a reference to the JavaScript library hosted on Facebook's server.
  3. When a user logs via the "Connect" button, then he calls a function in Facebook's JS API, which pops up a login dialog. This login box has an invisible iframe , in which the cross-domain communication file is full.
  4. The user fills the form and submits it, posts the form to Facebook.
  5. Checks Facebook Login If it is successful, then it communicates on your site. Here's where cross-domain comes:
    1. Due to cross-domain security policies, Facebook's login window can not inspect the DOM tree for documents hosted on your server. But within the login code src can update the contents of any iframe , and with the hosted cross-domain communication file Used to communicate on your page.
    2. When a cross-domain communication file receives a hint that the entry is successful, it uses JavaScript to set some cookies with the user's ID and session. Since this file resides on your server, those cookies have your domain and your backend can get them.
  6. Any other communication towards Facebook can be completed by inserting another nested code

Popular posts from this blog

MySql variables and php -

-
I am getting an error with php in order to format mysql_query () in php to format this string What is the right way? SELECT SELECT SELECT (*) Agents @AgentCount; User_Agent_English, User_Angent_Oursal, US.___Gent_Aginal, COUNT (User_Agent_Percade) ACC, COUNT (*) / (AgentCount) Percentage by agents user_agent_preser order DEC limit limit 50; In PHP, how am i setting $ query $ query = "SELECT count (*) agents @ agentcount; SELECT user_agent_parsed, User_agent_original , COUNT (user_agent_parsed) ascount, COUNT (*) / (@AgentCount) as a percentage by user_agent_parced by URI date DESC limit 50 "; This exact query will work properly if I put it in MySQL directly through a command line session. Do I need to release two separate php calls from mysql_query () and store the results first? I get the following error: There is an error in your SQL syntax; Instead of using a sub-selection and instead of using the 'SELECT user_agent_parsed, user_agent_original, ne...
Read more

url rewriting - How to implement the returnurl like SO in PHP? -

-
This URL should work even after the rewrite. Is this possible? Otherwise, I can only hardcoded everything If you are trying to create a login system with redirection You need to use the HTTP_REFERER header to find out where the user came from so that you can send it back there. The best way to do this is to use something like this in your login form: // - Login php & Lt; Input type = "password" name = "password" /> & Lt; Input type = "hidden" name = "returnrelale" value = "& lt ;? php echo $ redirectURL ;? & gt;" / & Gt; & Lt; / Form & gt; Please note that some ISP, browser or proxy will delete the referrer header, so you can not rely on each user to work fully. If you use a statement, to check whether the header exists or not, you can send those users back to the homepage or whatever. Edit If you are looking to use $ _SERVER ['REQUEST_URI'], if you are running Apache It sho...
Read more

Which Python client library should I use for CouchdB? -

-
I am starting to experiment with CouchDB because it looks like we have the right solution to certain problems That all the work will be on a new project, which does not have any legacy dependency, which the client library will suggest you use, and why? If we overlap any of the OS. Freeband is available only in the collection of its ports, but asks to use the library's project website. None of those people are Ubuntu, which is only with ships, since those two OSAs are not common in libraries, I am probably installing something from source (and hopefully if I have time, then Ubuntu and FreeBSD People pack the package). For those interests, I want to use CouchDB as a convenient intermediate storage space for data passed between different services - think of a message bus system, but less formalities with. For example, we have daemons that download and pars the web page, then send an interesting bit to other daemons for further processing. Many of them are ill-defined until the...
Read more