title: Tie facebook user to application user
body: <p>I'm developing an android app and I've a working login system using JWT. The user can create an account on my server and can login using his own username/password after that.
  I'd like to let the user login using Facebook, but I want his Facebook account to be tied to an account on my server.</p>
  
  <p>I've added the facebook login button to my app, and I can access facebook name and email. Is it safe to use the facebook email like this?</p>
  
  <ul>
  <li>User login with facebook</li>
  <li>App gets facebook email address and sends it to the server</li>
  <li>Server checks if the email is already registered, if so server generates a JWT and the user is now logged in. If not the server creates a new account</li>
  </ul>
  
  <p>Can I trust the email I get from the facebook login to authenticate the user or it can be tampered?
  Is there any better way to achieve this? Thanks.</p>
  
  <p>Edit: actually I know that sending just the email to my server wouldn't be safe. I was thinking about sending the Facebook access token too and then check on the server side if it's valid. Is this a good approach?
  Also I don't need a working e-mail address from the user, I just need an unique identifier for each user.</p>