title: Facebook login architecture
body: <p>I'm developing an App which uses Facebook to authenticate. So far, what I have is the following:</p>
  
  <ol>
  <li>Client->FB: authentication data (fb user &amp; password),</li>
  <li>FB->Client: FB id, FB token,...</li>
  <li>Client->AppServer: FB data (id, token,..)</li>
  <li>AppServer->Client: OK/Not OK, whatever necessary data.</li>
  </ol>
  
  <p>Where:</p>
  
  <ul>
  <li>Client: The App installed in the user's device (in this case, iOS),</li>
  <li>FB: FB server (the client talks to it through FB's SDK),</li>
  <li>AppServer: My App's server.</li>
  </ul>
  
  <p>The point of all these is to validate if the user is real. The problem is that in #3 the Client could be sending a random FB id or FB token to the AppServer, so the question is: is there anyway to check <strong>in the AppServer</strong> whether this FB data is indeed real?</p>