2

I've built a custom login page for a Wordpress site which uses Facebook for authentication.

Is there any reason to store the Facebook access token in my WP database, or does it make more sense to use a PHP session? Are there any benefits to storing these values on my server?

Improve this question
1
  • This seems mostly generic (as in WP is just implementation details here). Might be better asked at Stack Overflow?
    – Rarst
    May 27, 2014 at 18:42

2 Answers 2

Reset to default
3

There are a number of explanations here: https://developers.facebook.com/docs/facebook-login/access-tokens

The time it takes for your server to talk with facebook does contribute to a good amount of slowdown. So it depends on how intensely you plan to use the api. In that case, storing the key and other fb related user data can cut that cross-talk considerably.

If you are just using facebook as a login authenticator I don't think you need to bother.

Cheers.

Improve this answer
1
  • That's a helpful link - thanks Josh. Once I've got a few more reputation points I'll give you an upvote!
    – Matt Saunders
    Jun 22, 2014 at 17:33
0

The main reason not to save access keys in the WP database or a file is for security. See this article on how it affected one WP programmer and publisher.

http://wptavern.com/ryan-hellyers-aws-nightmare-leaked-access-keys-result-in-a-6000-bill-overnight

Improve this answer
1
  • Thanks Ray. I wouldn't be making anything visible to the public (as was the case here, all be it unintentional) so I think the risk of a leak would be much lower, but that's one hell of a cautionary tale.
    – Matt Saunders
    Oct 2, 2014 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.