|
|
|
|
|
|
by sawyer
5639 days ago
|
|
|
The user logs in on Facebook's server, there is no opportunity to change a uid. Facebook might return the logged in user's id, however that's not useful, the only way to interact with their API will be with the access token (which only grants you access to the logged in user's scope). |
|
|
Facebook returns a uid. When the user takes an action, this uid is sent to the server. The server trusts the uid, and saves this action as taken by the user identified by this uid.
And let's say it's not the uid. Let's say it's the user's name.
It trusts the user input basically. But it should probably be getting it directly from facebook, or in a signed structure, right?