1
\$\begingroup\$

I don't need to know the specific code required for that, but I want to understand at high level how can I implement that and what SDKs I have to use to achieve that.

  • Facebook PHP SDKs: Ok If I want to perform login with Facebook into my web page.

  • Unity3D's Facebook SDK: Ok If I want to perform login inside my App without a server (apart Facebook's servers of course).

What I want to achieve is:

  • User login into facebook from the App (just once, and eventually the option to log out on request of user, or to relog if login data expires)
  • Login is verified by my Server (actually a user should really have a facebook account)
  • Do not embed stuff like Facebook App ID in my App source code.

My server will store some data for each user and to identify users I need to be able to use some unique data provided by Facebook like session token etc. Of course the session token may change so I need anyway to be able to identify the user (to avoid losing memorized data).

\$\endgroup\$
5
+100
\$\begingroup\$

Token and App side

So to do this you will need to get the the relevant Access Token from facebook:

  • User Access Token if you want to post things on their behalf and access information about them.
  • App Access Token if you want to change app settings

You can read about it here but from what you have said you will probably want the User Access token.

After you get the access token you send it to your server using a unique ID for the user, this could be the device Serial Number or better the Google/Apple ID so that someone who sells their phone doesn't accidentally sell their account on your app as well.

When the app wants to do something with facebook it sends the request to your servers which then fulfil the request server side and possibly return something to the phone once they are done, the app could keep going doing more stuff and wait for a response in the background then inform the user.

Eventually the Token will expire, depending on exactly how you use the token your servers will have to check every account periodically, when they want to use it or when the user returns to the app. Once this happens you could try sending a push notification to the users phone or simply wait for them to return to the app where they will have to re authenticate with facebook in order to get a new token which is sent back to your server to replace the old one.

To summarise:

  1. User first logs into facebook to generate the Token for your app.
  2. Token is sent to your server along with identifying information
  3. Token is used to fulfil app requests (or whatever you want to use it for)
  4. Token expires and the user must re authenticate with Facebook and the new token is stored on the server.

SDK and server side

When you actually want to implement this you might not necessarily need the Unity SDK as that requires an appID to work. If you really want to use it you might have to find out where the AppID is stored and set it dynamically at startup before initializing the SDK. Otherwise you'll have make your own interface and pass all the login data through your server, if you do this use SSL to encrypt it when someone finds out that you're sending their login data without security you will not have a good week... Then once you have the data you do the query from your servers and give the app back the result (essentially a man in the middle between the app and facebook).

The servers would use the relevant SDK for whatever language they get coded in or just the web API since some languages (e.g. C#) have web handlers built in. You would need to build a REST API which can handle all the requests that you need the app to make. Keep security in mind here again because you don't want someone with a computer making random requests on the app's behalf, look into authentication techniques between your server and your app otherwise (again) you won't have a good week when (not if) somebody figures out your vulnerable.

\$\endgroup\$
  • \$\begingroup\$ Thanks you. This makes sense. So I just have to access AccessToken.CurrentAccessToken.TokenString and use it over a HTTPS connection to my server that will call proper FB API methods \$\endgroup\$ – GameDeveloper Jan 14 '17 at 12:31
  • 1
    \$\begingroup\$ yes and no, you will want to use the unique ID to talk to your server since the token will change over time. Initially (and when the token is updated) you will want to get the token in that way so the server knows what to send to facebook. The unique ID is also important if you save other information such as preferences on your server since that won't be on facebook you need a way to figure out what preferences to return. \$\endgroup\$ – user3797758 Jan 14 '17 at 13:31
  • \$\begingroup\$ Yes thanks, that was the kind of information I was looking for, then AccessToken.UserID to store information, and from time to time I refresh AccessToken on the App. Basically I store AcessToken on my app and send it everytime I need to interact with facebook to my server. Take the Bounty you deserve it :D (ops Have to wait 4 hours) \$\endgroup\$ – GameDeveloper Jan 14 '17 at 13:42
  • \$\begingroup\$ Glad I could help :) \$\endgroup\$ – user3797758 Jan 14 '17 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.