title: How to validate client send facebook data on server
body: <p>I'm using facebook login with javascript sdk for my web application. My application flow was</p>
  
  <ol>
  <li>User login to Facebook</li>
  <li>After user was logged in to Facebook, fetch user data.</li>
  <li>Send fetched user data back to my application to find or create user account</li>
  </ol>
  
  <p>The problem is I don't know how to check the send back data was valid or not.</p>
  
  <p><strong>index.html</strong></p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head lang="en"&gt;
      &lt;meta charset="UTF-8"&gt;
      &lt;title&gt;&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;input type="button" value="Login!" id="loginButton" onclick="authUser();"/&gt;
  
  &lt;div id="message"&gt;&lt;/div&gt;
  &lt;script type="text/javascript" src="/socket.io/socket.io.js"&gt;&lt;/script&gt;
  &lt;script type="text/javascript" src="//connect.facebook.net/en_US/all.js"&gt;&lt;/script&gt;
  &lt;script type="text/javascript"&gt;
      var io = io.connect();
      FB.init({
          appId: '412065755582960',
          xfbml: true,
          status: true,
          cookie: true
      });
      FB.getLoginStatus(checkLoginStatus);
  
      function authUser() {
          FB.login(checkLoginStatus, {scope: 'email'});
      }
  
      function checkLoginStatus(res) {
          if (res &amp;&amp; res.status == 'connected') {
              document.getElementById('loginButton').style.display = 'none';
              document.getElementById('message').innerHTML = 'User Logged In';
              loginToApp();
          } else {
              document.getElementById('loginButton').style.display = 'block';
          }
      }
  
      function loginToApp() {
          FB.api('/me', function (user) {
              //send data to server but what if user manually call it? How can I validate on server
              io.emit('login', {userID: user.id, email: user.email, name: user.name});
          });
      }
  &lt;/script&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>app.js</strong></p>
  
  <pre><code>var express = require('express.io'),
      app = express().http().io();
  
  app.io.set('transports', ['xhr-polling']);
  
  app.get('/', function (req, res) {
      res.sendfile('./index.html');
  });
  
  app.io.route('login', function (req) {
      //got user data via but how can I check these data were send via login flow or not.
      findOrCreateFacebookUser(req.data, function (err, user) {
          req.io.emit('userData', user);
      });
  });
  
  
  function findOrCreateFacebookUser(user, fn) {
      //some codes
  }
  
  app.listen(3000);
  </code></pre>