title: If our website sees the Facebook signed in user has user id 678678678 in the cookie, how do we know this cookie is not faked?
body: <p>I think if we make calls to Facebook using REST or Graph API, we will know if it is fake because it will come back saying fake session / auth_token / access_token.   But what if we are showing our own DB info, such as the user's "most preferred product list", then we don't make any call to Facebook but show our DB's data.  How do we know it is really the user, not somebody faking the cookie?</p>