Explain how FB connect authentication works

authentication facebook single-sign-on cas
Bot picture Bot · Jul 8, 2011 · Viewed 17.9k times · Source

I am working on a site that will allow users to create an account. Then website developers will be able to integrate that authentication system into their site and allow users to login with my sites login credentials. I am wanting to do it similar to the way facebook connect works so that the users site does not need to redirect to my site to login then we do a callback back to the page they came from.

I know facebook uses cookies but I am not sure how they are checking to see if they are logged in.

Things I have noticed:

  • If logged into facebook.com then you navigate to userssite.com that has Facebook Connect it will show you as logged in.
  • If you log out of userssite.com it will also log you out of facebook.
  • If you are logged out of facebook.com and login to userssite1.com then navigate to userssite2.com it will have you logged into that site as well.

Because of this, it looks like they are using cross domain cookies or something but I am not sure how to do this.

Can someone with knowledge of how Facebook Connect works exactly, explain how I can achieve this functionality in my own system?

Answer

daaku picture daaku · Jul 19, 2011

Facebook is moving largely to a OAuth 2.0 based solution. Our authentication guide and the official OAuth 2.0 draft spec are good places to start.

Related questions

Best way to implement Single-Sign-On with all major providers?

I already did a lot of research on this topic and have implemented a lot of solutions myself. Including OpenID, Facebook Connect (using the old Rest API and the new Graph OAuth 2.0 API), Sign in with twitter (which has been …

Read More
How do popular apps authenticate user requests from their mobile app to their server?

Say I have an Android application that connects to a .Net API for receiving/setting data. The confusion that I have is regarding how to sign-up/login the user first time and authenticate it every time they make a request …

Read More
Is Facebook an OpenID provider?

Is Facebook an OpenID provider? I know they are an OpenID supporter but do they allow people to authenticate with other sites via OpenID with their Facebook credentials?

Read More