title: Facebook mobile login and server-side validation
body: <p>I am working on a mobile app that has an integrated Facebook login (using the fb android sdk). I also have a server that has some rest endpoints on it that I would like to secure. I have been looking around for days trying to find the best solution (reading articles on the dev site: <a href="https://developers.facebook.com/docs/facebook-login/security">https://developers.facebook.com/docs/facebook-login/security</a>, other stackoverflow posts) but I am not quite sure what is the best solution.</p>
  
  <p>At the moment I have the following setup in place:</p>
  
  <ol>
  <li>User logs in on the app using Facebook (mobile android sdk).</li>
  <li>When requesting a resource from a rest endpoint the token will be added as a header.</li>
  <li>On the server side I validate the token using the fb debug_token endpoint (<a href="https://developers.facebook.com/docs/graph-api/reference/v2.5/debug_token">https://developers.facebook.com/docs/graph-api/reference/v2.5/debug_token</a>)</li>
  <li>If the validation is successful I allow my rest resource to be 'called'</li>
  </ol>
  
  <p>As you can see I will have do my own request to Facebook (server side) for every request I receive. Is there a better way to solve this problem?</p>
  
  <p>Thanks in advance!</p>