I've written a web application which uses Facebook as the main way to authenticate users and collect information. On the home page, there is one button 'Sign in with Facebook', which allows users to sign in to the app.
Is there any way to restrict which users can use the Facebook app, and thus log into my web app, or do I have to handle this separately/manually? My first idea was to add them as 'test users', because my app is still in beta phase, and thus not publicly accessible. But I'm not sure (and I can't find anywhere) how much test users are allowed per app (as this could be up to 1000 users over time).
You have to handle it manually. A good way to restrict access is to deny access in general, store authorized users and activate their access in a backend. You can´t just get their ID before authorization, because the ID is App Scoped.
Related
I am creating an app that only a specific list of users will use, and I need Instagram Public Content Access permission (and some other permissions) for them (I have my Instagram Business Account all set up and connected with Facebook page).
On https://developers.facebook.com/docs/facebook-login/review/examples/#screencast there is stated:
You do not need to submit your app if it will only be used by you or
by a reduced number of people. Any account listed in the Roles tab in
your App Dashboard, such as admins, developers and testers, can access
all permissions and generate a user or page access token.
So I just want to make sure, that it is completely fine in my case to keep my app in development mode and let my users use it like this (so I don't need to submit my app for review as long as all the users are going to have their role assigned in my app), and that these permissions are not intended just for a limited time period or only for testing/development purposes.
Thank you for any answer.
What you quoted there, is applicable to permissions your app is going to ask its users to grant to it.
Instagram Public Content Access is not a permission, it is a feature. You need to get it reviewed, if you want your app to be able to access content that the users of your app do not have admin access to.
https://developers.facebook.com/docs/apps/review/feature/#reference-INSTAGRAM_PUBLIC_CONTENT_ACCESS
Facebook provides an OAuth authentication system for third-party apps but they appear to not provide any fine-grained user management capabilities.
This seems like a security problem. I need to be able to:
Disable delete unused accounts
Disable or delete abusive users
White list users for early access to a new app.
But AFAICT FB provides no tool to do this.
I can probably hook of of the OAuth ID and put an entry in my database for the first two requirements, but I can't figure out how to white list Facebook users.
Google is unhelpful because all the results are about let users manage applications their user account is attached to, and nothing about allowing apps to manage what user accounts they are attached to...
Usually is a bad idea to delete or disable unused accounts, because maybe user was inactive for a long time, this doesn't mean the user deleted or disabled his account.
On the other hand, you can't avoid malicious users join your app via facebook authentication. What you can do is to detect suspicious activities with your own implementation (after Facebook accept them to join your app), and suspend, block or disable those accounts on the server (blacklisting them), after the user has joined client-side and sent the required access-token (optionally request the ID) trying to be accepted by the server.
Whitelisting users may depend on the requirements of your application, you can check profiles data and reject those that doesn't provide the requirements that your app needs (remember to ask the user for the fields that your app requires, like public profile, pictures, etc; these must be accepted by the user before signing in).
Here's how you white list users for an app on Facebook:
Keep the app in Development mode
Add users from your friend network in the Testers role
When you are comfortable, open your application to the world.
AFAICT you cannot white list when your app is published, but that's the point of publishing. Also the whitelist is not a request-grant method, it's invite only.
The other requirement to delete or disable users you must handle yourself in your database. You would tie the user's status to the FB's unique ID.
I have a Facebook Application in order to manage comments on my web page, allowing for moderation, etc.
I also have a Facebook Page, for the same brand.
Is there anyway of having an Administrator list that is shared between these two objects? So that I can add and remove users from one and they would get/lose access to the other?
There's no way to do this automatically, but you can:
Have a trusted user (admin of the page and app) grant manage_pages permission to [your/an] app
Get the page access token for managing the page - see "Page Login" on this document
Retrieve a list of the other page admins from /PAGE_ID/admins
Use the App Access Token to add those users as developers/admins/etc of the App by posting to the Application's 'Roles' connection
Those users will receive (and must accept) a request to become an admin/developer/etc of the app
Caveat: the users you try to add to the app must be verified accounts (via SMS or credit card) or they can't be ad admin or developer of the app
I'm NOT sure about this, but I never saw such thing available. Probably you'll have to integrate an application to your page that works on this
I'm using facebook connect to allow the visitors login to a website using their facebook account.
The only information needed is that the user id and name.
However the facebook connect dialog states that my app will access all the users friends, photos...
How can I configure my facebook application to not request those data?
The quick answer, you can't. The dialog states that you have the ability to access the user's information. Whether you access it or not is up to you, but the ability to is always there. There is a base level of access granted to all apps. You can prompt for extended permissions, but you can't customize the base level.
This may change going forward with OpenGraph. There are still features Facebook is adding, and some existing, undocumented features.
I want to build a Facebook application that will be available only to those who have been invited to it or to a certain list of people (the list will be used for initialization).
How can I achieve that?
Depends what you mean by available. Anyone can install/authorise your application - all it means is that it'll appear in their applications list, and that your application has more access to their profile.
However, whenever someone uses your application Facebook will send you their unique uid which you can then filter on within your own code. Store a list of uids that you consider "invited", and only allow them access.
Probably the neatest way to do this is at the start of a session; the initial exchange between Facebook and your application involves Facebook sending your app a uid and authentication token, with which your app requests a session key - if you filter at that point and simply refuse to request a session key for any uid that's not on your list, you can programmatically restrict access.
There is so called "application sandbox mode". It is intended for development and testing though. But the meaning of this mode - you directly specify what users have access to your app(testers)