How should I handle the user data after the user login through Facebook

Question

Currently I am using the traditional way to implement member system e.g. A user table and other related table (e.g. user_product) has a foreign key to link to that user

The problem is , how can I work with the member login through facebook? e.g.

• Should I used the retrieve info from facebook to create a new account for them automatically in my user table?

• Should I create a new table e.g. facebook user , then insert in it?

• Should I just ignore the login info, without adding it to my database?

The problem I encounter is there is an user_id and people login from facebook will not have it. Therefore, when they use the function e.g. purchase , I can not insert the record. However, if I add them to my user table, there is some info. missing e.g. password, phone..... So what is the common parctise of handling login through facebook? Thanks

Answer 1

There are a few different ways this is handled in practice. Some services require a user to still fill in information, even after the user clicked "Login through Facebook". Unless there is information that you absolutely need, I would advise against this approach.

You could take a polymorphic approach to users and have a regular users table and a Facebook users table. There are other ways to approach inheritance in SQL databases too, but this can get complicated.

A third approach would be to have Facebook id and auth tokens as nullable columns on your users table. This would also require you to either make the password column nullable, or set it to something long and random. This way, Facebook associated accounts function identically to other accounts, with the exception of of the way they sign in. Since you have their email, it should still be possible for Facebook users to make use of a "Reset password" option to get a password.

Edit:

You'll need to create columns for the things you need in order to maintain a Facebook record for a user. Facebook id, oauth token, and oauth secret are among these. When a user clicks sign in with facebook, upon receiving a response from Facebook, you should run a check to see if there is a user with the given facebook id. If one exists, sign the user in. Otherwise, create one.

Even easier would be to look at an OmniAuth solution. OPAuth is one such solution. Introducing something like this may require you to rework some existing code though.