Facebook Login Security

Transcript

1. Securing Login With Facebook API for Mobile Application
2. kiennt.com Kien Nguyen Lead Backend Engineer github.com/kiennt
3. Why I choose this topic
4. I hacked
5. Facebook Login Flow
6. Facebook Login Flow
7. Use client to get facebook data graph.facebook.com/me fb access token 1
8. Use client to get facebook data graph.facebook.com/me fb access token 1 user ’s facebook id 2
9. Use client to get facebook data graph.facebook.com/me fb access token 1 user ’s facebook id 2 facebook_id 3 your server
10. Use client to get facebook data graph.facebook.com/me fb access token 1 user ’s facebook id 2 facebook_id 3 your server your database get or insert base on facebook_id 4
11. Use client to get facebook data graph.facebook.com/me fb access token 1 user ’s facebook id 2 facebook_id 3 your server your database site access token 5 5 get or insert base on facebook_id 4
12. fake facebook_id 3 your server your database site access token 5 5 get or insert base on facebook_id 4 attacker Attacker only need to know facebook_id
13. Never trust data from client!
14. Use server to get facebook data your server fb access token 1
15. Use server to get facebook data your server fb access token 1 get user data 2
16. Use server to get facebook data your server fb access token 1 graph.facebook.com/me get user data 2 user facebook_id 3
17. Use server to get facebook data your server fb access token 1 graph.facebook.com/me your database get user data 2 user facebook_id 3 get or insert 4
18. Use server to get facebook data your server fb access token 1 graph.facebook.com/me your database site access token 5 5 get user data 2 user facebook_id 3 get or insert 4
19. Attacker use fake access token your server fake access token 1 graph.facebook.com/me your database site access token 5 5 get user data 2 user facebook_id 3 get or insert 4 attacker
20. Attacker use fake access token your server fake access token 1 graph.facebook.com/me your database site access token 5 5 get user data 2 user facebook_id 3 get or insert 4 attacker other fb application a valid facebook token
21. Always validate client data
22. How to fix? your server fb access token 1 graph.facebook.com/me your database site access token 5 6 get user data 3 user facebook_id 4 get or insert 5 graph.facebook.com validate fb access token 2
23. How to fix? https://developers.facebook.com/docs/facebook-login/access-tokens/debugging-and-error-handling GET /debug_token?input_token={input-token}&access_token={access-token}
24. Conclusion Do not use client to get facebook user data Use /debug_token to check access token is from your application
25. Remember Do not use client to get facebook user data Use /debug_token to check access token is from your application TRUST CIRCLE IS HIRING