2

I've built a custom login page for a Wordpress site which uses Facebook for authentication.

Is there any reason to store the Facebook access token in my WP database, or does it make more sense to use a PHP session? Are there any benefits to storing these values on my server?

Improve this question
1
  • This seems mostly generic (as in WP is just implementation details here). Might be better asked at Stack Overflow? – Rarst May 27 '14 at 18:42
3

There are a number of explanations here: https://developers.facebook.com/docs/facebook-login/access-tokens

The time it takes for your server to talk with facebook does contribute to a good amount of slowdown. So it depends on how intensely you plan to use the api. In that case, storing the key and other fb related user data can cut that cross-talk considerably.

If you are just using facebook as a login authenticator I don't think you need to bother.

Cheers.

Improve this answer
1
  • That's a helpful link - thanks Josh. Once I've got a few more reputation points I'll give you an upvote! – Matt Saunders Jun 22 '14 at 17:33
0

The main reason not to save access keys in the WP database or a file is for security. See this article on how it affected one WP programmer and publisher.

http://wptavern.com/ryan-hellyers-aws-nightmare-leaked-access-keys-result-in-a-6000-bill-overnight

Improve this answer
1
  • Thanks Ray. I wouldn't be making anything visible to the public (as was the case here, all be it unintentional) so I think the risk of a leak would be much lower, but that's one hell of a cautionary tale. – Matt Saunders Oct 2 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.