3

Let's say I have an iOS app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data).

Let's say I would like to add a 'login/register with Facebook' button so that our user don't have to fill a boring registration form.

My Database will still contain these users but they would have no username/password-hash/email, they will only be associated with a 'Facebook user ID' returned by the Facebook iOS SDK after in-app Facebook login.

So my API would have a call such as:

http://www.myapi.com/create_user_with_facebook?facebook_user_id=XXXXX

(OK, not exactly, it wouldn't be a GET, etc but you get my point)

What worries me here is that anyone would be able to call that API and create this kind of account with any publicly available Facebook user ID, even these that don't belong to them. No Data would be in danger or anything but when the legitimate owner of that Facebook account will try to use the app, the app will say 'NO, sorry, this Facebook account appear to be associated with an existing app account already!'

I have no idea how to protect our platform against this sort of 'attack'.

(the API would still allow registering an account the traditional way or syncing an existing account with a Facebook account - like it is common in so many apps these days)

Any help about which direction I should take to solve this problem would be greatly appreciated! Many Thanks.

1
  • 1
    Make a call to FB API to request the user’s basic info (/me) with the access token you got from FB login.
    – C3roe
    Commented Aug 8, 2014 at 19:10

2 Answers 2

1

Anyone could do the same thing with someone else's email address if they had access to your API (ie. I could call your API with someone else's email address and create a new account). So this isn't a "Facebook" issue. The solution is to secure your API if you don't want random people accessing it directly outside your app.

2
  • but there are no real way to secure an API access on a mobile right? No way to guarantee it's my app calling. Oauth2 and the like with key/secret on the code that can be reverse-engineered - from what I read, there is just no way that only my mobile code will access my API code. The only thing I can do is to design the API with session/token/user and the like, so that very little bad can be done even by another malicious app using it? Anyway, I'm not a specialist.
    – MikaelW
    Commented Aug 8, 2014 at 21:30
  • Maybe the solution to protect that first 'API registration call' from mass misuse is to include a server-validated mobile-friendly CAPTCHA in the registration form. All the subsequent API calls are protected with session-token and API-call-count monitored per user. What do you think?
    – MikaelW
    Commented Aug 8, 2014 at 23:12
1

What you can do in such case would be to send the access token your app get after successful Facebook login to your custom API. The API then will call facebook using the following URL to get emailId of the user -

https://graph.facebook.com/v2.2/me?fields=email&access_token=ACCESS_TOKEN

Your API will then check if the email is already in your user table or not. If it is then send the successful login message to the app, or if it's not there, you can either create a new entry and allow the user to signup or just send an error message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.