复用Android Facebook API的Access Token实现远程服务器登录

Hey there, let's walk through how to connect your Facebook-integrated Android app to your backend for proper user management—here's a practical, battle-tested approach:

First things first: you need to get the user's Facebook access token from your Android app to your backend safely, then verify it's legitimate.

• Transmit securely: Always send the token over HTTPS (never plain HTTP) to avoid interception. You can wrap it in a JSON payload for your login endpoint, like:

  {
    "fb_access_token": "USER_FB_TOKEN_HERE"
  }
  

• Server-side validation: Use Facebook's Graph API to confirm the token is valid, tied to your app, and belongs to the right user. Call the GET /debug_token endpoint with your app's access token and the user's token. This will return details like the user's Facebook ID, token expiry, and app ID—make sure the app ID matches yours to prevent token spoofing.

Now that you have a verified user, set up a way to manage their data on your server:

• User database schema: Create a table that links the user's Facebook ID (use this as a unique, immutable identifier) to their profile details—store things like their Facebook avatar URL, display name, and any custom user data your app needs (e.g., preferences, saved settings).
• Session management: Instead of relying on the Facebook token for every request, generate your own backend session token (like a JWT) to return to the app. This lets you control session expiry, reduce dependency on Facebook's API, and add extra security layers (like token revocation).
• Data sync: Periodically sync Facebook-related data (avatar, name) to your backend—do this when the user logs in, or when you detect changes via Facebook's webhooks (if you set those up).

Design endpoints that let your app interact with the backend for user management and data retrieval:

• POST /api/auth/fb-login: Accepts the Facebook access token, validates it, creates/updates the user in your database, and returns your backend session token + user profile data.
• GET /api/user/profile: Fetches the stored user profile (combines Facebook data and custom app data).
• PUT /api/user/profile: Lets users update their custom app-specific information (e.g., bio, notification settings).
• GET /api/user/albums: Proxies Facebook Graph API requests to fetch the user's albums (this way, your app doesn't need direct access to Facebook's API for this, keeping sensitive logic server-side).
• POST /api/user/post: Handles requests to publish posts/photos—your backend uses the stored long-lived Facebook token to call Facebook's API, keeping the token secure on the server instead of the client.

Don't skip these—they'll keep your user data safe:

• Use long-lived Facebook tokens: Short-lived tokens expire in hours, so exchange them for long-lived ones (valid for ~60 days) using Facebook's GET /oauth/access_token endpoint. Store this on your backend, and refresh it before it expires.
• Encrypt sensitive data: Store the long-lived Facebook token and your backend session tokens in encrypted form in your database. On Android, store the backend session token using the Android Keystore system instead of plain SharedPreferences.
• Validate all requests: Every request to your backend should include your session token—verify its validity before processing the request.

Tokens don't last forever, so plan for this:

• On the client, use Facebook's SDK to listen for token expiry events. If the token expires, prompt the user to re-authenticate (the SDK can often do this silently if the user is still logged into Facebook on their device).
• On the backend, if you try to use a Facebook token and get an error, return a specific error code to the app. The app can then trigger a re-login flow and send a new token to the backend to update the stored one.

This setup keeps user management centralized, reduces client-side complexity, and gives you control over your app's data flow while still leveraging Facebook's powerful authentication and data tools.

内容的提问来源于stack exchange，提问作者Yu-Chih