Last year we helped the Deb shops run the Deb Model Search. One of the features we used was a simple login script. A user had to register with the site and give some information like name, email, username and a password in order to submit a profile or to vote. A registered user could only vote for a model once per day.
What ended up happening was some people used web applications to create fake email accounts as a way to get around the rules and vote for a model more than once a day. We ended up catching on to this when searching which email addresses were voting for the profiles.
One way to solve this is to use Facebook’s Single Sign-on (SSO). Using SSO as the registration process for your site enables users to log on with their Facebook account. Once a user logs in to your site with his or her Facebook account, you can access the user’s account information from Facebook, and the user is logged in to your site as long as he or she is logged in to Facebook.
This also enables social sharing with their friends on their walls when they submit or vote – integrating your site with Facebook.
To do this you need to be part of the Facebook developers group and create a new application to get an application ID. Here is some example code to set up a quick page to test:
<?php
define('FACEBOOK_APP_ID', '116515581710958');
define('FACEBOOK_SECRET', 'a35d0afaddf41e092de8261f49d1f8c9');
function get_facebook_cookie($app_id, $application_secret) {
$args = array();
parse_str(trim($_COOKIE['fbs_' . $app_id], '\\"'), $args);
ksort($args);
$payload = '';
foreach ($args as $key => $value) {
if ($key != 'sig') {
$payload .= $key . '=' . $value;
}
}
if (md5($payload . $application_secret) != $args['sig']) {
return null;
}
return $args;
}
$cookie = get_facebook_cookie(FACEBOOK_APP_ID, FACEBOOK_SECRET);
?>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:fb="http://www.facebook.com/2008/fbml">
<body>
<?php if ($cookie) { ?>
Your user ID is <?= $cookie['uid'] ?>
<?php } else { ?>
<fb:login-button></fb:login-button>
<?php } ?>
<div id="fb-root"></div>
<script src="http://connect.facebook.net/en_US/all.js"></script>
<script>
FB.init({appId: '<?= FACEBOOK_APP_ID ?>', status: true,
cookie: true, xfbml: true});
FB.Event.subscribe('auth.login', function(response) {
window.location.reload();
});
</script>
</body>
</html>
When a user clicks on the login button a popup will appear with the facebook login box.
After the user logins in they will be presented with an access box which will allow your web site to connect to that users profile.
After the access window you now have access to the facebook user id stored as a cookie. You can use this ID in your code for registered users on your site. We used this feature in the RO*TEL Across America Recipe contest which uses the Facebook Login, Facebook Like, and Google Maps.
