security - Do I need to check if a Facebook UserID provided by a client is actually a valid UserID? -
for instance, let's i'm getting picture user. client code might call mysite.com/api/getprofilepicture?user=000123 , app send url appropriate image load. internally, it'd making api call /v2.6/{user_id}/picture literally taking user parameter receives , placing in string. think want keep serverside client doesn't have worry profile picture comes (if end adding, example, google+ login in future).
is security concern? nefarious user make call mysite.com/api/getprofilepicture?user=destructiveendpoint , have run /v2.6/destructiveendpoint/picture? or there no such destructive endpoints worry (since app secret not being used here). if there are destructive endpoints worry about, should making sure whatever userid valid 1 before using it, correct?
so after sql injection comes api parameter injection :)
if take arbitrary string , put somewhere graph api url, theoretically scenarios imaginable lead unwanted results, yes.
but every api endpoint create/alter/delete needs access token - in fact, / picture endpoints ones don't.
so if able "inject" api call, outcome api complain operation needs valid access token.
maybe i'd manage inject access token, - make same api call outside of app, too.
for now, facebook profile ids contain digits - if want validate input, that's check for. (but fb engineers have stated on multiple occasions, might change in future well.)
