Let's say I have an iOS app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data).
Let's say I would like to add a 'login/register with Facebook' button so that our user don't have to fill a boring registration form.
My Database will still contain these users but they would have no username/password-hash/email, they will only be associated with a 'Facebook user ID' returned by the Facebook iOS SDK after in-app Facebook login.
So my API would have a call such as:
http://www.myapi.com/create_user_with_facebook?facebook_user_id=XXXXX
(OK, not exactly, it wouldn't be a GET, etc but you get my point)
What worries me here is that anyone would be able to call that API and create this kind of account with any publicly available Facebook user ID, even these that don't belong to them. No Data would be in danger or anything but when the legitimate owner of that Facebook account will try to use the app, the app will say 'NO, sorry, this Facebook account appear to be associated with an existing app account already!'
I have no idea how to protect our platform against this sort of 'attack'.
(the API would still allow registering an account the traditional way or syncing an existing account with a Facebook account - like it is common in so many apps these days)
Any help about which direction I should take to solve this problem would be greatly appreciated! Many Thanks.
/me
) with the access token you got from FB login.