Authentication : Facebook user access token validation on server side?

Question

A lot of questions here are talking about validation process of Facebook access token on the server side. I am bit confused how is still secure?

My client and server flows are:

1. User Continue with Facebook using Mobile SDK on the client side.
2. Facebook returns User access token to the client side.
3. Server endpoints receive user access token (via POST method) and validate the access_token using Graph API.
4. In case of authenticated user return the JWT authorization token in response
5. In the meantime (within an hour), If hackers find out the endpoint and pass the new access_token to the hacked endpoint.

What will happen if 5th point gets executed? It's difficult to hack the POST parameters but it might be possible after decompiling the app and see the classes file (At least for android apk). In this case, Server will not recognize the forged request and will always return the JWT Authorization token to make further calls.

The validity of Facebook access_token is 60 days. Do I need to provide an extra layer of security at the time of validation endpoint to make sure that the request is only coming from the application?

Is facebook user access_token always changing whenever a user is requesting to sign in?

Any kind of help would be appreciable. Thanks

Answer 1

Solution:

Generated access_token will always belongs to an App. To verify it pass the access_token and app_tokenin:

https://graph.facebook.com/debug_token?
access_token=ACCESS_TOKEN
&app_token=APP_TOKEN