title: How to verify user login when using Facebook Javascript SDK
body: <p>I've already gone through this <a href="https://stackoverflow.com/questions/11223226/javascript-sdk-automatically-login">question</a>, but my question is different. I am unsure of how can javascript login be sure and how can some-else not login into others account.</p>
  
  <p>According to the <a href="https://developers.facebook.com/docs/javascript/quickstart" rel="nofollow noreferrer">getting started</a> <code>FB.authResponse</code> is called when the login is successful, but in the client's side of course. </p>
  
  <p>Then we can get the <code>userId</code> &amp; <code>accessToken</code> out of the response, we can also make call to <code>/me</code> to get more information. In order to put that user into session, all this info about successfull javascript login has to be sent to the server and this is where I get confused.
  After all it's HTTP, every other request is different and can be replicated.</p>
  
  <p>May be it's just that I'm confused, about how someone can't hack and immitate any other users' facebook id to login into his account.</p>
  
  <p>For e.g. after the authentication is success, I make an ajax call to my server providing 
  the fb-user-id and then I match it with the database and put the appropriate user in the session, but not since this is fb-user-id is not verified again in the back-end (or is it verified?, I didn't found anything though about it) that this particular user is the one who actually signed up in my application, then a same login request with someone else's fb-user-id can be made to login into his account.</p>
  
  <p>I'm sure, I'm not the first one to have this confusion. Please help to clear this confusion, as I've read the docs many times now, but still unable to figure out why can't someone else login into someone else's account.</p>
  
  <p><em>EDIT</em>
  I found this <a href="https://stackoverflow.com/questions/6868590/facebook-backend-login"><code>similar question</code></a> but the guy here doesn't answer how he verified backend login or may be I was unable to understand.</p>